Solved

can't find crontab maybe deleted. Need to find or reconstruct.

Posted on 2013-01-04
6
417 Views
Last Modified: 2013-02-09
Ok. I did "crontab -" then "crontab -l". When I hit the crontab -l nothing was returned. I think I may have deleted with that command or accidentally in the crontab -e. Is it really deleted? If not, how can I find it? If yes, how can I restore it? I did a some research online and found some examples but the grep commandname1 /var/log/cron was giving me the error message "Permission denied." The history doesn't seem to show the scripts that were executed in the last 24 hours. Is there a way to do that so I can recreate it manually?

986      9:51      crontab -1
   987      10:23      crontab -
   988      10:23      crontabl -l
   989      10:23      crontab -u rhuff -1
   990      10:23      ld
   991      10:23      crontab
   992      10:26      crontab -e
   993      10:38      pwd
   994      10:38      cd ..
   995      10:38      ls
   996      10:38      crontab -l
   997      10:40      cat /var/spool/cron/*
   998      10:41      grep commandname1 /var/log/cron
   999      10:42      cd /var/cron
  1001      10:49      history
0
Comment
Question by:libertyforall2
  • 2
  • 2
  • 2
6 Comments
 
LVL 37

Expert Comment

by:Gerwin Jansen, EE MVE
ID: 38746412
When the cron file has been deleted and you have no backup of it, recovery is not possible.

/var/log/cron is giving you access denied: look at the file with "ls -l /var/log/cron" and you'll probably see that it's accessible for root only. So either become root or ask you sysadmin to do the grep command for you.

From the /var/log/cron logfile you should be able to recover the commands that were in your crontab file, the schedule you would have to recreate.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 38746515
as already said, if you aciddently deleted the crontab you can only recover it from your backup

the location of crontab file depend on your *ix flaviour, some common places are
  /var/log/cron/
  /var/spool/cron/
  /var/spool/cron/crontab/
  /var/spool/cron/crontabs/
  /var/spool/crontabs/
  /etc/crontab/
  /etc/crontabs/

in any directory the name of the crontab file for a user is the systems username (in your example probably rhuff)
use find as root to check for crontab files
0
 

Author Comment

by:libertyforall2
ID: 38746596
Problem was there was no backup. That said, is there a way to do a history search of processes automatically initiated within the last 24-48 hours or do some type of modified history search and reconstruct it manually?
0
Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

 
LVL 37

Assisted Solution

by:Gerwin Jansen, EE MVE
Gerwin Jansen, EE MVE earned 250 total points
ID: 38746614
Have a look in the suggested log files / locations mentioned. If you know specifics, look in logfiles for applications/scripts that may have been started by cron. Ask an admin for assistance if you need to because you cannot access all logfiles needed as some are protected, as you've seen already.
0
 
LVL 51

Accepted Solution

by:
ahoffmann earned 250 total points
ID: 38746621
syslog (or messages again on newer systems) should contain a entry like:
Jan 23 23:23:23 marvin crontab[4711]: (root) BEGIN EDIT (root)
0
 

Author Closing Comment

by:libertyforall2
ID: 38871394
Thanks.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A short article about a problem I had getting the GPS LocationListener working.
This is an explanation of a simple data model to help parse a JSON feed
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question