Orphaned Cron jobs?

[JayBaen]

A few days ago via Nodeworx, I deleted a particular Siteworx account that I handled. That site had a few associated Cron jobs that I would have expected to be removed along with the account.

Interestingly, I'm still receiving emails from the Cron job indicating:
/bin/sh: line 1: /home/blah/blah/blah/blah.pl: No such file or directory

... daily from the 3 now defunct Cron jobs.

Is there a way (or a need) to surgically remove these scripts from trying to execute?

JB

[CMI]

You can log in, switch to root, and crontab -u userdoma -r where userdoma is the Linux user InterWorx created and delete them.

[IWorx-Socheat]

If CMI's suggestion doesn't work (and I have a feeling it might not, as the user is already deleted off the system), su to root and do:

rm -f /var/spool/cron/<uniqname>

Where <uniqname> is the <uniqname> of the deleted account.

[IWorx-Chris]

"uniqname" = Unix username here :).

[JayBaen]

Found them here:

/var/spool/cron/<uniqname>

I've removed and will see the result in the AM.

Thx much.

JB

[JayBaen]

Alrighty ... that worked to solve that part of the equasion, however, I'm now getting a few more of these than I'd like daily:

ORPHAN (no passwd entry)

In the logwatch.

I've read that this is usually due to something trying to run a cron job against a non-existent user account. I've checked what I can and don't see any rogue cron jobs left. Any thoughts on where to hunt?

JB

[timryberg]

I've checked what I can and don't see any rogue cron jobs left. Any thoughts on where to hunt?

If you hadn't already, the upgrade to 1.9.1 would have taken care of those. Not sure what the priblem here is.

[JayBaen]

Thx Tim for the reply.

I *believe* I'm at 1.9.1 -- all upgrades are set to auto-install.

JB

[timryberg]

If you log into NodeWorx and click Server Setup and scroll down it will list your InterWorx version.

[JayBaen]

Yeppirs .. 1.9.1

[JayBaen]

Seems like I've still got a bunch of these showing up daily:

--------------------- Cron Begin ------------------------

**Unmatched Entries**
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)

---------------------- Cron End -------------------------

The only Cron job that I know is running is an ipcheck script that's bringing up any of the eth0:x interfaces if they happen to go down (... right...a bandaid, I know).

Is there another place to hunt for rogue Crons besides /var/spool/cron?

JB

[IWorx-Chris]

on redhat boxes crons could run from a few spots:

/var/spool/cron
/etc/crontab
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly

I'd check all those spots JB.

Chris

[JayBaen]

Hey Chris,

You know, it's not as if I haven't checked those locations before, but somehow someone telling you to go look there again is a nice two-by-four to the head.

I did find a few jobs in cron.daily that were left over from an old firewall script that has since been removed -- yet the crons remained. I'll see if removing them keeps these entries out of the logwatch.

I'm sure one of the rogue crons explains why my new firewall rules kept getting flushed every morning as well <sigh>.

Thanks again.

JB

[IWorx-Chris]

[QUOTE=JayBaen]
I'm sure one of the rogue crons explains why my new firewall rules kept getting flushed every morning as well <sigh>.
/QUOTE]

If you're using apf then the 'fw' cron job could do it. Look for an iptables cron job also in cron.daily.

Chris

[JayBaen]

Yes .. I *was* using APF, then removed it -- or so I thought ... : /

In any case, I'll find out in the next day or two if all the Orphans are gone or not.

JB

[JayBaen]

That did it. All the orphans have gone home to rest.

Removing the leftovers of APF, Dshield, BFD etc.

Regards,

JB