Hello,

I am a new system admin, and the previous admin left no updating documentation. On more than one of my servers, a tar file is created once per day, but there is no backup job listed in my /etc/crontab file. Is there a way to figure out what script is creating these files? Help!

What distribution/version is the server running? There are several ways other then /etc/crontab. If tar file was created via a cron job it should be in the log files which should indicate how it was run. Which log file depends on the distribution.

It could be in roots crontab or /etc/cron.daily file.

It is running on CentOS.

Version 6 or 7? Do you have a /var/log/cron file?

If you can't figure it out from /var/log/cron, check root's crontab

You can also look in /var/spool/cron each file in there is the crontab for a specific user. You may find that there's a dedicated "backup" user that's running the job.

When I checked /var/log/cron, I found that /etc/cron.daily/makewhatis.cron runs about the same time that these tar files are being created. This is the code for makewhatis.cron. It doesn't seem like this is what would be making the tar files, unless I'm wrong on that?

#!/bin/bash

LOCKFILE=/var/lock/makewhatis.lock

# the lockfile is not meant to be perfect, it's just in case the
# two makewhatis cron scripts get run close to each other to keep
# them from stepping on each other's toes. The worst that will
# happen is that they will temporarily corrupt the database...
[ -f $LOCKFILE ] && exit 0

# if MAKEWHATISDBUPDATES variable is set to "n" or "N", then the
# update will not passed

MDU=`sed -n -e 's/^[[:blank:]]*MAKEWHATISDBUPDATES[[:blank:]]*\(.\)[[:blank:]]*$/\1/p' < /etc/man.config`
([ "$MDU" == "n" ] || [ "$MDU" == "N" ]) && exit 0

trap "{ rm -f $LOCKFILE ; exit 255; }" EXIT
touch $LOCKFILE
# Rebuild the database if makewhatis was since last full run,
# otherwise just update with new pages
if [ ! -f /var/cache/man/whatis ] ||
find /usr/sbin/makewhatis -newer /var/cache/man/whatis |grep -q .
then
makewhatis -w
else
makewhatis -U -w
fi
exit 0

Also, I'm running CentOS 6.6

It isn't makewhatis.cron.

Have you looked at the other files in cron.daily?
These are the default so are there other files?
Have you looked at the /var/spool/cron files

There is nothing in /var/spool/cron. Mlocate.cron shows this:

cat mlocate.cron
#!/bin/sh
nodevs=$(< /proc/filesystems awk '$1 == "nodev" { print $2 }')
renice +19 -p $$ >/dev/null 2>&1
ionice -c2 -n7 -p $$ >/dev/null 2>&1
/usr/bin/updatedb -f "$nodevs"

logrotate shows this:

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

readahead.cron looks like this:

#!/bin/bash

#
# Generates sorted readahead files
#
# Copyright (C) 2007 Red Hat, Inc.
# Karel Zak <kzak@redhat.com>
#

renice +19 -p $$ >/dev/null 2>&1
ionice -c3 -p $$ >/dev/null 2>&1

TYPES="early later"
READAHEAD_CMD="/sbin/readahead"
READAHEAD_BASE="/var/lib/readahead"

for LTYPE in $TYPES; do
if [ -s "$READAHEAD_BASE/custom.$LTYPE" ]; then
FLS="$READAHEAD_BASE/custom.$LTYPE"
else
FLS=$(ls $READAHEAD_BASE/*.$LTYPE 2>/dev/null )
fi

if [ -n "$FLS" ]; then
$READAHEAD_CMD --sort --output=$READAHEAD_BASE/$LTYPE.sorted $FLS &>/dev/null
fi
done


I don't think it's these.

What I was attempting to post was that none of the default scripts above should create a tar file. If there is a script in your cron.daily that is not in the above list that would be something to investigate.

About the only thing left to look at is /etc/anacrontab

Or maybe the tar file is created by a command run remotely from another server.

On my CentOS servers /etc/cron.daily is a directory, not a file, and contains several scripts that are all run at the same time each day. That seems to be the most likely place for the script you're looking for, since the tar files are created at about the same time as the makewhatis.cron script runs. Try to see if that yields any clues.

My /etc/anacrontab just re-runs /etc/cron.daily (among other things).

Thanks to TenTenths for the lesson that user's crontabs are located in /var/spool/cron...I did not know that.

One option is to look at the timestamps of these tarballs. Are they created at a consistent time of day? If so, you can set up a script that runs around that time and records the output of "ps -ef" on a regular (fast) interval. You should be able to find the tar process that fires up around that time, and trace pids to figure out the name of the script that's calling it. From there it should be relatively easy to track it down.

[code]
ll /etc|grep cron
-rw-------. 1 root root 541 Aug 24 2016 anacrontab
drwxr-xr-x. 2 root root 4096 Apr 7 2017 cron.d
drwxr-xr-x. 2 root root 4096 Jun 5 08:45 cron.daily
-rw-------. 1 root root 0 Aug 24 2016 cron.deny
drwxr-xr-x. 2 root root 4096 Mar 24 2017 cron.fivem
drwxr-xr-x. 2 root root 4096 Aug 25 2016 cron.hourly
drwxr-xr-x. 2 root root 4096 Dec 14 2015 cron.monthly
-rw-r--r--. 1 root root 573 Mar 24 2017 crontab
drwxr-xr-x. 2 root root 4096 Sep 27 2011 cron.weekly
[/codee]
Basically, check all those files/dirs - it'll be in there somewhere (although I'd skip anacrontab).

You'll actually find that they are executed in alphabetical order and not concurrently.