How to Find a Fugitive Crontab

cron

A few years ago I setup a cron job to automatically ping a URL every minute as part of a monitoring system (that's oversimplification, but it'll do for this question). Because I'm a horrible person, I didn't document this anywhere.

Today, years later, I started having trouble with the application on the other end of the URL that's being pinged. I fixed it, but then realized, I have no idea where this cron job is coming from.

Is there a way to quickly search through or cat out all the crontabs on a particular system? I have root access so permissions aren't a problem. I've only ever been a user of cron, I've never looked too deeply at its implementation, but my *nix instincts say there has to be a group of text files somewhere that hold all the crontabs. I just don't know where they'd be, and if I dug into it I'd be afraid of finding some, but not all of them, or missing some weird nuance of the system

Also, I realize with root access I could

Get a list of all the users in the system
su as a user
crontab -l
Repeat with all the users

but I'm looking for something a little less manual (and looking to learn something about cron's implementation)

Best Answer

There are only a few places crontabs can hide:

/etc/crontab
/etc/cron.d/*
/etc/crond.{hourly,daily,weekly,monthly}/*
these are called from /etc/crontab, so maybe an asterisk on this
/var/spool/cron/* (sometimes /var/spool/cron/crontabs/*)

Be sure to check at as well, which keeps its jobs in /var/spool/at/ or /var/spool/cron/at*/

Also, instead of

su <user>
crontab -l

Just do this:

crontab -lu <user>

Related Solutions

Cron GUI Dialog – How to Display a Zenity Dialog After Root Cron Task Completion

Try adding something like the following to your ~/.xinitrc (or ~/.xsession if you use a login manager):

while true; do
    if [[ -a ~/.messages ]]; then
        zenity --info --text="$(printf "%q" $(cat ~/.messages))"
        rm ~/.messages
    fi
    sleep 10
done &

I haven't tested this with zenity as I don't have it and I'm assuming that .xsession works as expected - I've never used a login manager.

The while/done block will execute indefinitely with a ten second delay between checks (the sleep 10 part). Each time there's a check, the if guard succeeds if there's a non-empty file called .messages in the user's homedir. On success, the contents of the file are read into zenity and the file is removed.

I'm not thrilled with the printf vomit, but it should be fine.

The content that gets put into ~/.messages should be redirected from cron and you'll need to make sure you change the owner and group of the file appropriately. Perhaps something like:

10 * * * * /usr/bin/mything && echo "mything completed" > /home/username/.messages && chown username:groupname /home/username/.messages

Crontab: “Temporary crontab no longer owned by you.”

You need to edit permissions on the crontab binary and set them back to what they are when you do a fresh install.

NOT WORKING permissions:

ls -la /usr/bin/crontab
-rwsr-xr-x 1 root crontab 40264 Oct  7  2017 /usr/bin/crontab

Action, do as root or using sudo:

chmod g+s /usr/bin/crontab
chmod u-s /usr/bin/crontab

WORKING permissions:

ls -la /usr/bin/crontab
-rwxr-sr-x 1 root crontab 40264 Oct  7  2017 /usr/bin/crontab

Taken from a fresh working installation, the working permissions are set during installation.

No idea why they changed later on.