I have a script that exports logs from log management server and send those exports to the archiver server.

When I run this script manually, it complete it's task without any problem. It download the exports and send the files to my other server. The thing is, when I write a cronjob to automize this work flow, it just downloads the files from the log management server but it can't send the files to my archiver server.

The script is as follow:


/opt/splunk/bin/splunk search "(sourcetype=*) earliest=-15m" -output rawdata -maxout 0 > /opt/access_archive/archive_ALL_EXPORTS.dmp

cdate=$(date +"%Y%m%d_%H%M%S")
shopt -s extglob
mv "$exported_file" "${cdate}_$exported_file"
scp ${cdate}_$exported_file root@<IP_ADDRESS>:/root

As you can see in the script, I download the dmp file with the name of archive_ALL_EXPORTS.dmp and put exact date time prefix to the name of this file. Than when I try to send this file with scp, it doesn't do anything.

Crontab is as follow:

* * * * * /usr/bin/bash /opt/access_archive/export.sh

I also tried:

* * * * * /opt/access_archive/export.sh

Also cron use bin/bash: (/etc/crontab)



I also try with this script in case there is a mistake because of escape characters but the result is the same.


/opt/splunk/bin/splunk search "(sourcetype=*) earliest=-15m" -output rawdata -maxout 0 > /opt/access_archive/archive_ALL_EXPORTS.dmp

scp archive_ALL_EXPORTS.dmp root@<IP_ADDRESS>:/root
  • 1
    How is the SSH authentication handled with scp. Are you getting errors from the cron daemon in your email (root's email, probably)? – Kusalananda Jul 5 '19 at 9:08
  • If scp is failing, it's probably producing an error message. Like @Kusalananda says, cron may be mailing error messages to the crontab owner. Or you could modify the script to write output and errors to some kind of log file. – Kenster Jul 5 '19 at 15:41
  • @Kusalananda I have created ssh key pairs with "ssh-keygen" and copy the local host public keys to the remote host authorized_keys file. As I said, when I manually run the script, it doesn't ask for a password and send the file to the remote server. I also check the root's email. At the end of the output there is a strange thing: "INFO: archive_ALL_EXPORTS.dmp: No such file or directory". The thing is, when I list the files in directory, it is there as this exact name. – G.Baysec Jul 6 '19 at 9:53
  • @Kenster I did that but the only output I get is "INFO: Your timerange was substituted based on your search string" – G.Baysec Jul 6 '19 at 9:53

There isn't a need for escape characters or sth else. I forgot to give the full path for the file as in below command. After that, it worked.

mv "/opt/access_archive/$exported_file" "/opt/access_archive/${cdate}_$exported_file"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.