Gangmax Blog

The Invisible Cron Job

On a server we know there is a database backup process which runs twice a day but there is nothing related in the “crontab -e” text content. Why?

So I create a script and let it run(refer here):

test.rb
1
2
3
4
5
6
# Usage: ruby test.rb > test.log
while true
  output = `ps -o pid,sess,cmd afx | grep -A20 "cron$"`
  puts output
  puts '-----------------------------------'
end

Then I found the following output in the log file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
 3507  3507 /usr/sbin/cron
 2179  3507  \_ /usr/sbin/cron
 2183  2183  |   \_ /bin/sh -c    test -x /usr/sbin/anacron || ( cd / && /root/work/scripts/testlinkBackup.sh )
 2190  2183  |       \_ /bin/sh -c    test -x /usr/sbin/anacron || ( cd / && /root/work/scripts/testlinkBackup.sh )
 2180  3507  \_ /usr/sbin/cron
 2185  2185  |   \_ /bin/sh -c  test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1
 2193  2185  |       \_ /bin/sh -c  test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1
 2181  3507  \_ /usr/sbin/cron
 2186  2186  |   \_ bash /var/www/web_report/script/accessForCache.sh
 2191  2186  |   |   \_ bash /var/www/web_report/script/accessForCache.sh
 2192  3507  |   \_ /usr/sbin/cron
 2182  3507  \_ /usr/sbin/cron
 2187  2187      \_ /usr/sbin/cron
...
-----------------------------------

So I realize it’s still called by “cron” although it’s not in “crontab -e”. Google and find this post. Then I found the “/etc/crontab” has the following content:

1
2
3
4
5
6
7
8
9
SHELL=/bin/sh
PATH=/usr/bin:/usr/sbin:/sbin:/bin:/usr/lib/news/bin
MAILTO=root
#
# check scripts in cron.hourly, cron.daily, cron.weekly, and cron.monthly
#
-*/15 * * * *   root  test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1
0 5    * * *   root    test -x /usr/sbin/anacron || ( cd / && /root/work/scripts/testlinkBackup.sh )
0 18    * * *   root    test -x /usr/sbin/anacron || ( cd / && /root/work/scripts/testlinkBackup.sh )

So that’s it. And more, here is the differences between “crontab -e” and “/etc/crontab”.

Comments