Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a server I inherited, there is a cron job running hourly on one of the Debian servers. It sends an email out to a non-existent email, but bounces back to my account since I listed myself as the root email in /etc/aliases. The cron job has been deleted from /etc/cron.hourly (it was ntupdate), as it's listed in the email. I reloaded the crontab daemon, but I am still getting hourly reports that the file failed to launch, and the email address does not exist!

The output that is getting emailed:

run-parts: failed to exec /etc/cron.hourly/ntpdate: Exec format error
run-parts: /etc/cron.hourly/ntpdate exited with return code 1

Currently, there is just the .placeholder hidden file in /etc/cron.hourly. I also ran crontab -l, and the only 3 jobs listed are expected to be listed, and are running about 10 minutes after this email keep arriving; so I know it is not one of those. Where can I look next to stop getting these emails?


# ls -l /var/spool/cron
total 4
drwx-wx--T 2 root crontab 4096 Jan 25  2012 crontabs


# ls -l /var/spool/cron/crontabs/
total 4
-rw------- 1 root crontab 311 Jan 25  2012 root
# more /var/spool/cron/crontabs/root
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.4nUf85/crontab installed on Wed Jan 25 10:11:10 2012)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
2 1 * * * /etc/webmin/cron/tempdelete.pl
0 22 * * * /etc/init.d/gnugk stop
0 23 * * * /etc/init.d/gnugk start

This is on Debian Squeeze, using just cron, as far as I can tell

share|improve this question
What distribution is this (I assume you are on Linux)? Which cron? There are differences between the implementations on different distros. How did you reload the cron daemon? Is rebooting the server an option? – terdon Jul 31 '13 at 19:13
Are these emails really coming from that server? Are they recent? – sendmoreinfo Jul 31 '13 at 19:16
@terdon Updated. Can reboot, but would prefer not to – Canadian Luke Jul 31 '13 at 19:25
@sendmoreinfo Yes, they are coming from the root@*servername* account. They are happening at 29 minutes past the hour, every hour – Canadian Luke Jul 31 '13 at 19:25
And I imagine you have run service cron restart? – terdon Jul 31 '13 at 19:27
up vote 3 down vote accepted

system crons

Did you look through these files & directories to make sure there isn't a duplicate cronjob present?

  • /etc/crontab
  • /etc/cron.hourly/
  • /etc/cron.d/
  • /etc/cron.daily/
  • /etc/cron.hourly/
  • /etc/cron.monthly/
  • /etc/cron.weekly/

Also any files present in these directories that's executable will be run. Doesn't matter if it's a .placeholder name or whatever. You can use chmod 644 ... to disable any script that is executable.

user crontabs

Also check the following directory to see if there are any user's that have created their own crontabs:

For example:

$ sudo ls -l /var/spool/cron/
total 0
-rw------- 1 saml root 0 Jun  6 06:43 saml
share|improve this answer
Updated again :) – Canadian Luke Jul 31 '13 at 19:24
@CanadianLuke - does the syslog show anything else? /var/log/syslog. – slm Jul 31 '13 at 19:28
I see that the restart happened of the CRON service, but nothing after that (Skipping @reboot jobs -- not system startup) – Canadian Luke Jul 31 '13 at 19:34
@CanadianLuke - do you have anacron along with cron setup to run? – slm Jul 31 '13 at 19:39
@CanadianLuke - do the emails show that it's running now or are these emails queued up and just getting delivered now? – slm Jul 31 '13 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.