LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 10-10-2004, 08:35 PM   #1
chadi
Member
 
Registered: Aug 2004
Posts: 96

Rep: Reputation: 15
cronjob problem


Now I have this major problem (reason why I am checking cronbjobs). I am getting tons of emails regarding some eggdrop of some sort. I am not sure why because that is disabled (or should I say prevented) in WHM (checked) as running processes.

I ran cronbtab -e again and got this:


2,58 * * * * /usr/local/bandmin/bandmin
0 0 * * * /usr/local/bandmin/ipaddrmap
15 2 * * * /scripts/upcp
*/15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
*/5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1
0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1


/etc/cronbtab shows this:


SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

How do I track this bad crobjob doewn exactly?

Using Fedora Core 2 i686
 
Old 10-10-2004, 08:42 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914
The next step would be to check the directories
Quote:
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly
and see whether there's anything in there
that resembles eggdrop.


Cheers,
Tink
 
Old 10-10-2004, 08:46 PM   #3
chadi
Member
 
Registered: Aug 2004
Posts: 96

Original Poster
Rep: Reputation: 15
All empty. Any other ideas? rootkit hunter was all "ok" too
 
Old 10-10-2004, 08:53 PM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914
Can you post one of the messages? Might help with
assessing it ...


Cheers,
Tink
 
Old 10-10-2004, 08:55 PM   #5
chadi
Member
 
Registered: Aug 2004
Posts: 96

Original Poster
Rep: Reputation: 15
I don't have any on file (the user did not reply to me with that). Anything else we can do?
 
Old 10-10-2004, 09:09 PM   #6
chadi
Member
 
Registered: Aug 2004
Posts: 96

Original Poster
Rep: Reputation: 15
Ok I got this in /var/spool/cron

gvllweb
--------

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/gvllweb/.crontab installed on Mon Apr 19 00:06:17 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
0 * * * * http://domain.com/modules/MS_Analysi...aintenance.php

cadenza
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/cadenza/.crontab installed on Wed Mar 3 22:52:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="cadenza"

mailman
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/cpanel/src/3rdparty/gpl/mailman-2.1.5/cron/crontab.in installed on Sun Oct 10 18:54:09 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO=postmaster
# At 8AM every day, mail reminders to admins as to pending requests.
# They are less likely to ignore these reminders if they're mailed
# early in the morning, but of course, this is local time...
0 8 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs
#
# At 9AM, send notifications to disabled members that are due to be
# reminded to re-enable their accounts.
0 9 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled
#
# Noon, mail digests for lists that do periodic as well as threshhold delivery.
0 12 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests
#
# 5 AM on the first of each month, mail out password reminders.
0 5 1 * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/mailpasswds
#
# Every 5 mins, try to gate news to mail. You can comment this one out
# if you don't want to allow gating, or don't have any going on right now,
# or want to exclusively use a callback strategy instead of polling.
#0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/gate_news
#
# At 3:27am every night, regenerate the gzip'd archive file. Only
# turn this on if the internal archiver is used and
# GZIP_ARCHIVE_TXT_FILES is false in mm_cfg.py
27 3 * * * /usr/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip

nibuhaho
----------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/nibuhaho/.crontab installed on Sat Aug 14 00:54:37 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="nibuhaho"
0 0 * * * /home/nibuhaho/public_html/perlbill/include/auto_cron.cgi

nobody
---------

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/usr/local/flash/psfonts/.dat//.autobotchk installed on Sat Sep 18 17:11:11 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (cron.d installed on Sat Sep 18 17:04:05 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
* * * * * /home/gvllweb/public_html/images/language/.psy/y2kupdate >/dev/null 2>&1
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//Fandy.botchk
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//psfonts.botchk
0,10,20,30,40,50 * * * * /usr/local/flash/psfonts/.dat//D00r.botchk

root
-----
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/scripts/.crontab installed on Sun Oct 10 20:34:03 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)

2,58 * * * * /usr/local/bandmin/bandmin
0 0 * * * /usr/local/bandmin/ipaddrmap
15 2 * * * /scripts/upcp
*/15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1
*/5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1

terri
-----
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/terri/.crontab installed on Fri Mar 19 08:38:43 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO=""
*/30 * * * * wget -q -O /dev/null http://domain.com/cal/tools/send_reminders.php

webhost
---------
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/home/webhost/.crontab installed on Wed Sep 22 12:27:42 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
MAILTO="doug@webhost-galaxy.com"
0 * * * * GET http://www.domain.com/whoiscart/collector.php >/dev/null
0 3 7 * * GET http://www.domain.com/whoiscart/collector.php


What is normal and what should not be there?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Problem with cronjob Arndt Linux - Newbie 1 04-05-2005 05:40 AM
cronjob problem ashley75 Linux - General 2 05-28-2004 05:47 PM
cronjob help meeh Linux - General 1 03-26-2004 11:41 AM
cronjob ugob Linux - Software 0 03-03-2004 09:20 AM
cronjob FastEddy Linux - General 1 04-12-2003 09:52 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 04:17 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration