I have sar running on my server and it kills it sometimes with using too much memory. Ive deleted the cron job out of /etc/cron.d/sysstat and chmodded the /usr/lib64/sa dir 000. But i still get emails from crond saying it cant run the program. How do i get crond from wanting to look for sa or sar and trying to run it. Its not in any other crons, ive searched all crontab, cron.daily, cron.weekly, cron.monthly, etc...

There is nothing in /var/spool/cron. Here is an example of the emails i keep getting:

From: cron daemon
/bin/sh: /usr/lib64/sa/sa1: Permission denied


Thanks in advance

try

Yes, and flood your term when you "try" that ^^^

Read "man sa1" and if you can't fix it, then post back.

Thanks guys but neither one of those helped, the grep -iR 'sa' /etc scrolled 10 million things and nothing really pointed me in the right direction and the man page for sa1, sar and anything related i've already read.

There is nothing sa related in cron, that i can see. If you have any other suggestions please let me know.


Thanks,

my apols

I have tested a new search that produces one line for me....yes I should have tested my last....try with root powers

grep -wr '\<'sa'\>'--fixed-strings /etc ....then if you notice only a few lines or none you can try sa1 etc

No prob aus9, thanks for reposnding so quickly. Running that didnt point me in the right direction. Thanks for trying though. I may give up and just dev/null the emails. But it sure would be nice to know for furture reference what is causing them.

me too after my last puny effort.

http://freshmeat.net/projects/sysstat/

shows some more search terms... sadf...iostat ....pidstat....mpstat

2) I am sure you have already looked at all of your /etc/cron....and /etc/crontab so maybe you have a rc.local or other script that is calling cron?

eg
find / -name crond

/etc/netprofile/profiles/default/services/crond
/etc/rc.d/init.d/crond
/etc/pam.d/crond
/var/lock/subsys/crond
/usr/sbin/crond

find / -name cron

/etc/logrotate.d/cron
/var/log/cron
/var/spool/cron

what I am trying to suggest...trying to recover some dignity...is you have mail from cron so its the cron daemon but which?

Thanks again aus9. Those didint help but looking again in the /var/log/cron file i see where it tries to run as part of /etc/cron.hourly but looking there i dont see any cron jobs at all. Maybe this info can help find a solution?

/var/log/cron:

Apr 13 12:01:01 servername crond[26070]: (root) CMD (run-parts /etc/cron.hourly)


whats in cron.hourly:

ls -la
total 24
drwxr-xr-x 2 root root 4096 Sep 20 2004 .
drwxr-xr-x 90 root root 12288 Apr 12 09:47 ..

I do not run a server....can you stop crond and restart it? I am aware you do not like taking down the server....but on its next scheduled downtime...a full reboot might fix the issue if the restart fails?

Mdv has a gui to stop it /usr/sbin/crond so here is how to do it with rh if you did not know
http://www.cyberciti.biz/faq/howto-l...-restart-cron/

What is the time stamp on the emails you're getting? That may provide another clue. Also, although you've checked /var/log/cron it may be worth running crontab -l (that's a lower case "L") as root to see if there is anything being run outside of /etc/cron.*. For example I have a box here with the following in root's crontab:

Hi Steve,

If you re-read my very first post, ive already deleted that cron job and said there is nothing in /var/log/cron. Thanks for trying though. Actually i found the solution. In ps accounting there is a script that calls sar to run. If you chmod that 000 it will stop crond from trying to run the program.


Aus9, thanks for your help. Restarting crond isnt really a big deal on a server, ive done it several times.