10

On a server I inherited, there is a cron job running hourly on one of the Debian servers. It sends an email out to a non-existent email, but bounces back to my account since I listed myself as the root email in /etc/aliases. The cron job has been deleted from /etc/cron.hourly (it was ntupdate), as it's listed in the email. I reloaded the crontab daemon, but I am still getting hourly reports that the file failed to launch, and the email address does not exist!

The output that is getting emailed:

/etc/cron.hourly/ntpdate:
run-parts: failed to exec /etc/cron.hourly/ntpdate: Exec format error
run-parts: /etc/cron.hourly/ntpdate exited with return code 1

Currently, there is just the .placeholder hidden file in /etc/cron.hourly. I also ran crontab -l, and the only 3 jobs listed are expected to be listed, and are running about 10 minutes after this email keep arriving; so I know it is not one of those. Where can I look next to stop getting these emails?

EDIT #1

# ls -l /var/spool/cron
total 4
drwx-wx--T 2 root crontab 4096 Jan 25  2012 crontabs

EDIT #2

# ls -l /var/spool/cron/crontabs/
total 4
-rw------- 1 root crontab 311 Jan 25  2012 root
# more /var/spool/cron/crontabs/root
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.4nUf85/crontab installed on Wed Jan 25 10:11:10 2012)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
2 1 * * * /etc/webmin/cron/tempdelete.pl
0 22 * * * /etc/init.d/gnugk stop
0 23 * * * /etc/init.d/gnugk start

This is on Debian Squeeze, using just cron, as far as I can tell

16
  • What distribution is this (I assume you are on Linux)? Which cron? There are differences between the implementations on different distros. How did you reload the cron daemon? Is rebooting the server an option?
    – terdon
    Commented Jul 31, 2013 at 19:13
  • Are these emails really coming from that server? Are they recent? Commented Jul 31, 2013 at 19:16
  • @terdon Updated. Can reboot, but would prefer not to Commented Jul 31, 2013 at 19:25
  • @sendmoreinfo Yes, they are coming from the root@*servername* account. They are happening at 29 minutes past the hour, every hour Commented Jul 31, 2013 at 19:25
  • And I imagine you have run service cron restart?
    – terdon
    Commented Jul 31, 2013 at 19:27

1 Answer 1

5

system crons

Did you look through these files & directories to make sure there isn't a duplicate cronjob present?

  • /etc/crontab
  • /etc/cron.hourly/
  • /etc/cron.d/
  • /etc/cron.daily/
  • /etc/cron.hourly/
  • /etc/cron.monthly/
  • /etc/cron.weekly/

Also any files present in these directories that's executable will be run. Doesn't matter if it's a .placeholder name or whatever. You can use chmod 644 ... to disable any script that is executable.

user crontabs

Also check the following directory to see if there are any user's that have created their own crontabs:

For example:

$ sudo ls -l /var/spool/cron/
total 0
-rw------- 1 saml root 0 Jun  6 06:43 saml
9
  • Updated again :) Commented Jul 31, 2013 at 19:24
  • @CanadianLuke - does the syslog show anything else? /var/log/syslog.
    – slm
    Commented Jul 31, 2013 at 19:28
  • I see that the restart happened of the CRON service, but nothing after that (Skipping @reboot jobs -- not system startup) Commented Jul 31, 2013 at 19:34
  • @CanadianLuke - do you have anacron along with cron setup to run?
    – slm
    Commented Jul 31, 2013 at 19:39
  • 1
    @CanadianLuke - do the emails show that it's running now or are these emails queued up and just getting delivered now?
    – slm
    Commented Jul 31, 2013 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .