I have a problem, some user ,and I'm not sure who, on one of my servers wrote a cronjob that executes every night at midnight. The cronjob creates a sql dump of a database which is then grabbed by another server and gzipped.

The problem that I'm experiencing is that once that has occurred the file on the local system is no longer needed and I'd like to remove it in an hour or so. Which in, and of itself is not an issue but I don't know where to go to find the crontab for the person in question. Can anyone think of a way to find the cronjob from all the potential places that one could store a cronjob?

  • 1
    If you know the approximate time you could search for it in /var/log/cron. My cron logs both the crontab file and the user who scheduled the job.
    – manatwork
    Sep 15, 2011 at 15:25
  • I would but /var/log/cron doesn't seem to exist.
    – Mark D
    Sep 15, 2011 at 15:56
  • Then see what /etc/syslog.conf (the actual name may slightly vary on the syslog implementation; the rsyslog I have uses rsyslog.conf) says about where cron logs. On some systems it goes to /var/log/messages.
    – manatwork
    Sep 15, 2011 at 15:58
  • 1
    @Mark D, check out unix.stackexchange.com/questions/7053/… which lists several locations to look for crontabs of users Sep 15, 2011 at 18:10
  • 1
    @Mark, what OS are you working on? Sep 15, 2011 at 18:28

1 Answer 1


On solaris at least, look in /var/spool/cron/crontabs

  • Not familiar with Solaris, but as far as I know it also has /etc/cron.daily/.
    – manatwork
    Sep 15, 2011 at 17:42
  • 1
    @manatwork, but Joe User should not be able to write to /etc/cron.daily ... Sep 15, 2011 at 18:09
  • Right, but in my (mis?)understanding root is not excluded from the possible job owners.
    – manatwork
    Sep 15, 2011 at 18:23
  • 2
    On linux, at least for vixie-cron, it is the same as glenn suggested. The files under /var/spool/cron/crontabs contain users' crontabs. Sep 16, 2011 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .