LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 03-24-2010, 06:18 PM   #1
bubnoff
Member
 
Registered: Jun 2009
Location: Northwest
Distribution: Slackware
Posts: 43

Rep: Reputation: 16
Runaway cron job filling up var


I can't find where this job is running from! I uninstalled cacti
and deleted all directories and such associated with it, but there continues to be a rogue cronjob that I can't find and it's filling the var directory with logs.

I tried listing all cronjobs on the system with this:
Code:
for USER in `cut -d ":" -f1 </etc/passwd`; do crontab -u ${USER} -l 1>/dev/null 2>&1; if [ ! ${?} -ne 0 ]; then echo -en "--- crontab for ${USER} ---\n$(crontab -u ${USER} -l)\n"; fi; done
It reports all the jobs I found manually. Here's a log sample from mail
that points to a rogue cacti cronjob:

Code:
From www-data@manny.fakedomain.org  Wed Mar 24 15:35:01 2010
Date: Wed, 24 Mar 2010 15:35:01 -0700
From: root@manny.fakedomain.org (Cron Daemon)
To: root@manny.fakedomain.org
Subject: Cron <www-data@fakedomain> php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log
Content-Type: text/plain; charset=UTF-8
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/www>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=www-data>

/bin/sh: /var/log/cacti/poller-error.log: No such file or directory
I looked at www-data's crontab entries and they are lacking in substance
to the point of not existing.

Any ideas?

Thanks for reading!

Bub
 
Old 03-24-2010, 07:10 PM   #2
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
cron.daily ?

If it's running as root and using php to do it there can't be that many places ...

/usr/share/cacti/site/poller.php is a good thing to delete. Maybe reading the cacti docs will give a clue ?

Last edited by smoker; 03-24-2010 at 07:11 PM.
 
Old 03-24-2010, 07:38 PM   #3
bubnoff
Member
 
Registered: Jun 2009
Location: Northwest
Distribution: Slackware
Posts: 43

Original Poster
Rep: Reputation: 16
Thanks for the reply. I made an extensive sweep of the system and there is nothing left of cacti. The problem now is the mysterious cronjob that's trying to run a non-existent program and log to a non-existent file.

I tried cron.daily as you suggested and grepped around for cacti and php to no avail. One lead I have is that the logs in mail are timed at five minutes apart. So I try and read up and figure out where that job gets installed in Debian.

Thanks ~

Bub
 
  


Reply

Tags
cron


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Runaway /var/log/messages-20080823 garyg007 Linux - General 5 08-27-2008 03:00 PM
/var/log/messages filling up space. Asim Ahmed Linux - Newbie 1 04-09-2008 01:10 AM
/var/log problem : it's filling up at lightspeed Sabinou Mandriva 22 01-24-2008 02:08 PM
adding a perl script to cron.daily / cron.d to setup a cron job CrontabNewBIE Linux - Software 6 01-14-2008 08:16 AM
Problems with /var filling up ALL the time. ritec Linux - General 4 03-20-2007 04:55 PM


All times are GMT -5. The time now is 09:43 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration