2

I have used RHEL6/CentOS6 before and some application work good on my system.
Now I have a new CentOS 7 installation,something confused me.
I create a cron job with user myuser, like this:

*/4 * * * * echo "hello" > /tmp/test.txt  

There is some files in /tmp directory, such as myfile1,myfile2...myfile, all these file belongto myuser
This cron works fine in my RHEL6 system,but in CentOS7 all files belong to myuser in /tmp will be deleted as long as the cron job execute
I find these in /var/log/cron

Aug 15 21:03:01 zw_21_66 crond[15029]: (myuser) RELOAD (/var/spool/cron/mrd)  
Aug 15 21:04:01 zw_21_66 CROND[11762]: (myuser) CMD (echo "hello" > /tmp/test.txt)  

and these in journalctl

Aug 15 21:04:01 zw_21_66 systemd[1]: Created slice user-1001.slice.  
Aug 15 21:04:01 zw_21_66 systemd[1]: Starting user-1001.slice.  
Aug 15 21:04:01 zw_21_66 systemd[1]: Started Session 11530 of user myuser.  
Aug 15 21:04:01 zw_21_66 systemd[1]: Starting Session 11530 of user myuser.  
Aug 15 21:04:01 zw_21_66 CROND[11762]: (myuser) CMD (echo "hello" > /tmp/test.txt)  
Aug 15 21:04:02 zw_21_66 systemd[1]: Removed slice user-1001.slice.  
Aug 15 21:04:02 zw_21_66 systemd[1]: Stopping user-1001.slice.  

I have checked tmpfile.d but found nothing; how can I find the killer who deleted my file?

Recently I solved this problem by edit /etc/pam.d/crond,Commented out entry:

#session    include    password-auth

But I have no idea why it works, any suggestions?

  • 3
    Are you sure you're not just getting hit with the RHEL7 /tmp cleanup job in systemd? Check unix.stackexchange.com/questions/118754/… for more information. – Thomas N Aug 15 '16 at 14:50
  • Thx.I have read it, and checked systemd-tmpfiles-clean.timer in my system.I'm sure that myfile was deleted when cron job execute.Shall i edit my post? – Gee.Fu Aug 16 '16 at 2:50
  • Can you install sysdig? If so, what does something like the following show going on? sysdig -p '%proc.pname[%proc.ppid]: %proc.name -> %evt.type(%evt.args)' syscall.type contains unlink and evt.args contains /tmp – thrig Aug 16 '16 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.