Link to home
Start Free TrialLog in
Avatar of libertyforall2
libertyforall2Flag for United States of America

asked on

can't find crontab maybe deleted. Need to find or reconstruct.

Ok. I did "crontab -" then "crontab -l". When I hit the crontab -l nothing was returned. I think I may have deleted with that command or accidentally in the crontab -e. Is it really deleted? If not, how can I find it? If yes, how can I restore it? I did a some research online and found some examples but the grep commandname1 /var/log/cron was giving me the error message "Permission denied." The history doesn't seem to show the scripts that were executed in the last 24 hours. Is there a way to do that so I can recreate it manually?

986      9:51      crontab -1
   987      10:23      crontab -
   988      10:23      crontabl -l
   989      10:23      crontab -u rhuff -1
   990      10:23      ld
   991      10:23      crontab
   992      10:26      crontab -e
   993      10:38      pwd
   994      10:38      cd ..
   995      10:38      ls
   996      10:38      crontab -l
   997      10:40      cat /var/spool/cron/*
   998      10:41      grep commandname1 /var/log/cron
   999      10:42      cd /var/cron
  1001      10:49      history
Avatar of Gerwin Jansen
Gerwin Jansen
Flag of Netherlands image

When the cron file has been deleted and you have no backup of it, recovery is not possible.

/var/log/cron is giving you access denied: look at the file with "ls -l /var/log/cron" and you'll probably see that it's accessible for root only. So either become root or ask you sysadmin to do the grep command for you.

From the /var/log/cron logfile you should be able to recover the commands that were in your crontab file, the schedule you would have to recreate.
as already said, if you aciddently deleted the crontab you can only recover it from your backup

the location of crontab file depend on your *ix flaviour, some common places are
  /var/log/cron/
  /var/spool/cron/
  /var/spool/cron/crontab/
  /var/spool/cron/crontabs/
  /var/spool/crontabs/
  /etc/crontab/
  /etc/crontabs/

in any directory the name of the crontab file for a user is the systems username (in your example probably rhuff)
use find as root to check for crontab files
Avatar of libertyforall2

ASKER

Problem was there was no backup. That said, is there a way to do a history search of processes automatically initiated within the last 24-48 hours or do some type of modified history search and reconstruct it manually?
SOLUTION
Avatar of Gerwin Jansen
Gerwin Jansen
Flag of Netherlands image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks.