Where is this cronjob running?

Question

We have a news server running on a CentOS 6.5 box. It's leafnode, and a cron is set to run every two minutes. We decide to shut it down to troubleshoot other issues, so we comment out the line in the crontab:

# */2 * * * * /usr/sbin/fetchnews

For some reason, however, we're still getting news articles updated. So we decide to change the permissions of that binary.

chmod 400 /usr/sbin/fetchnews

Then, we start to get e-mails every two minutes: '/usr/sbin/fetchnews: permission denied'.

We look in /etc/cron/hourly, in fact in everything to do with crond in /etc. It's not in root's crontab file, it's not in the news user's crontab file, and it's not in any other user's crontab file.

How can I find out what is causing this binary to be run?

Thanks.

Answer 1

Try grep -ri fetchnews /etc/cron* /var/spool/cron/tabs/*.

Are there any more results besides the line you commented out?

Answer 2

watch "ps -ef | grep fetchnews"

will show you the output of ps -ef | grep fetchnews every two seconds. In the output of ps -ef, the parent pid is the third field, 1458 in this case:

ulmi      1462  1458  0 18:20 pts/1    00:00:00 sh -c ps -ef | grep ls

That's the job that spawned your fetchnews, and it might help you on.

(My crystal ball says that maybe you tried to edit the crontabs directly? Only running crontab -e is guaranteed to make crond pick up the new tab.)

Answer 3

Assuming there's a user that owns the news files there's likely a cron entry in this user's personal crontab entry which is responsible for this. User crons are maintained here on RHEL systems:

$ sudo ls -l /var/spool/cron/
total 4
-rw-------. 1 slm slm 9 Oct  6 13:30 slm

If you see entries there you can use sudo to see what's in a given file like so:

$ sudo crontab -u slm -l
### blah

You can simply comment out the entries in this file, using crontab to disable it from running. If your work is fairly brief you could also disable the cron service temporarily:

$ sudo service crond stop