LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 10-25-2017, 03:55 PM   #1
patrickwilson82
LQ Newbie
 
Registered: Oct 2017
Posts: 14

Rep: Reputation: Disabled
Backups not in Cron


Hello,

I am a new system admin, and the previous admin left no updating documentation. On more than one of my servers, a tar file is created once per day, but there is no backup job listed in my /etc/crontab file. Is there a way to figure out what script is creating these files? Help!
 
Old 10-25-2017, 04:20 PM   #2
michaelk
Moderator
 
Registered: Aug 2002
Posts: 21,625

Rep: Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187
What distribution/version is the server running? There are several ways other then /etc/crontab. If tar file was created via a cron job it should be in the log files which should indicate how it was run. Which log file depends on the distribution.

It could be in roots crontab or /etc/cron.daily file.
 
Old 10-25-2017, 05:32 PM   #3
patrickwilson82
LQ Newbie
 
Registered: Oct 2017
Posts: 14

Original Poster
Rep: Reputation: Disabled
It is running on CentOS.
 
Old 10-25-2017, 05:36 PM   #4
michaelk
Moderator
 
Registered: Aug 2002
Posts: 21,625

Rep: Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187
Version 6 or 7? Do you have a /var/log/cron file?
 
Old 10-25-2017, 08:32 PM   #5
scasey
LQ Veteran
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.8.2003
Posts: 5,442

Rep: Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070
If you can't figure it out from /var/log/cron, check root's crontab
Code:
su -
[root pw]
crontab -l
 
Old 10-26-2017, 03:08 AM   #6
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 3,213

Rep: Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400
You can also look in /var/spool/cron each file in there is the crontab for a specific user. You may find that there's a dedicated "backup" user that's running the job.
 
Old 10-26-2017, 08:08 AM   #7
patrickwilson82
LQ Newbie
 
Registered: Oct 2017
Posts: 14

Original Poster
Rep: Reputation: Disabled
When I checked /var/log/cron, I found that /etc/cron.daily/makewhatis.cron runs about the same time that these tar files are being created. This is the code for makewhatis.cron. It doesn't seem like this is what would be making the tar files, unless I'm wrong on that?

#!/bin/bash

LOCKFILE=/var/lock/makewhatis.lock

# the lockfile is not meant to be perfect, it's just in case the
# two makewhatis cron scripts get run close to each other to keep
# them from stepping on each other's toes. The worst that will
# happen is that they will temporarily corrupt the database...
[ -f $LOCKFILE ] && exit 0

# if MAKEWHATISDBUPDATES variable is set to "n" or "N", then the
# update will not passed

MDU=`sed -n -e 's/^[[:blank:]]*MAKEWHATISDBUPDATES[[:blank:]]*\(.\)[[:blank:]]*$/\1/p' < /etc/man.config`
([ "$MDU" == "n" ] || [ "$MDU" == "N" ]) && exit 0

trap "{ rm -f $LOCKFILE ; exit 255; }" EXIT
touch $LOCKFILE
# Rebuild the database if makewhatis was since last full run,
# otherwise just update with new pages
if [ ! -f /var/cache/man/whatis ] ||
find /usr/sbin/makewhatis -newer /var/cache/man/whatis |grep -q .
then
makewhatis -w
else
makewhatis -U -w
fi
exit 0
 
Old 10-26-2017, 08:09 AM   #8
patrickwilson82
LQ Newbie
 
Registered: Oct 2017
Posts: 14

Original Poster
Rep: Reputation: Disabled
Also, I'm running CentOS 6.6
 
Old 10-26-2017, 09:36 AM   #9
michaelk
Moderator
 
Registered: Aug 2002
Posts: 21,625

Rep: Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187
It isn't makewhatis.cron.

Have you looked at the other files in cron.daily?
These are the default so are there other files?
Quote:
00webalizer cups makewhatis.cron prelink tmpwatch
certwatch logrotate mlocate.cron readahead.cron
Have you looked at the /var/spool/cron files
 
Old 10-26-2017, 09:59 AM   #10
patrickwilson82
LQ Newbie
 
Registered: Oct 2017
Posts: 14

Original Poster
Rep: Reputation: Disabled
There is nothing in /var/spool/cron. Mlocate.cron shows this:

cat mlocate.cron
#!/bin/sh
nodevs=$(< /proc/filesystems awk '$1 == "nodev" { print $2 }')
renice +19 -p $$ >/dev/null 2>&1
ionice -c2 -n7 -p $$ >/dev/null 2>&1
/usr/bin/updatedb -f "$nodevs"

logrotate shows this:

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

readahead.cron looks like this:

#!/bin/bash

#
# Generates sorted readahead files
#
# Copyright (C) 2007 Red Hat, Inc.
# Karel Zak <kzak@redhat.com>
#

renice +19 -p $$ >/dev/null 2>&1
ionice -c3 -p $$ >/dev/null 2>&1

TYPES="early later"
READAHEAD_CMD="/sbin/readahead"
READAHEAD_BASE="/var/lib/readahead"

for LTYPE in $TYPES; do
if [ -s "$READAHEAD_BASE/custom.$LTYPE" ]; then
FLS="$READAHEAD_BASE/custom.$LTYPE"
else
FLS=$(ls $READAHEAD_BASE/*.$LTYPE 2>/dev/null )
fi

if [ -n "$FLS" ]; then
$READAHEAD_CMD --sort --output=$READAHEAD_BASE/$LTYPE.sorted $FLS &>/dev/null
fi
done


I don't think it's these.
 
Old 10-26-2017, 10:43 AM   #11
michaelk
Moderator
 
Registered: Aug 2002
Posts: 21,625

Rep: Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187Reputation: 4187
What I was attempting to post was that none of the default scripts above should create a tar file. If there is a script in your cron.daily that is not in the above list that would be something to investigate.

About the only thing left to look at is /etc/anacrontab

Or maybe the tar file is created by a command run remotely from another server.
 
Old 10-26-2017, 03:22 PM   #12
scasey
LQ Veteran
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.8.2003
Posts: 5,442

Rep: Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070Reputation: 2070
On my CentOS servers /etc/cron.daily is a directory, not a file, and contains several scripts that are all run at the same time each day. That seems to be the most likely place for the script you're looking for, since the tar files are created at about the same time as the makewhatis.cron script runs. Try
Code:
grep tar /etc/cron.daily/*
to see if that yields any clues.

My /etc/anacrontab just re-runs /etc/cron.daily (among other things).

Thanks to TenTenths for the lesson that user's crontabs are located in /var/spool/cron...I did not know that.
 
Old 10-26-2017, 04:04 PM   #13
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138
One option is to look at the timestamps of these tarballs. Are they created at a consistent time of day? If so, you can set up a script that runs around that time and records the output of "ps -ef" on a regular (fast) interval. You should be able to find the tar process that fires up around that time, and trace pids to figure out the name of the script that's calling it. From there it should be relatively easy to track it down.
 
Old 10-26-2017, 07:58 PM   #14
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,873

Rep: Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600
[code]
ll /etc|grep cron
-rw-------. 1 root root 541 Aug 24 2016 anacrontab
drwxr-xr-x. 2 root root 4096 Apr 7 2017 cron.d
drwxr-xr-x. 2 root root 4096 Jun 5 08:45 cron.daily
-rw-------. 1 root root 0 Aug 24 2016 cron.deny
drwxr-xr-x. 2 root root 4096 Mar 24 2017 cron.fivem
drwxr-xr-x. 2 root root 4096 Aug 25 2016 cron.hourly
drwxr-xr-x. 2 root root 4096 Dec 14 2015 cron.monthly
-rw-r--r--. 1 root root 573 Mar 24 2017 crontab
drwxr-xr-x. 2 root root 4096 Sep 27 2011 cron.weekly
[/codee]
Basically, check all those files/dirs - it'll be in there somewhere (although I'd skip anacrontab).
 
Old 10-27-2017, 08:47 AM   #15
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 3,213

Rep: Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400Reputation: 1400
Quote:
Originally Posted by scasey View Post
On my CentOS servers /etc/cron.daily is a directory, not a file, and contains several scripts that are all run at the same time each day.
You'll actually find that they are executed in alphabetical order and not concurrently.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Keep Your /home Safe With Cron Backups LXer Syndicated Linux News 0 07-28-2017 05:10 AM
USB tar backups fail in cron, not from command line StikShift Linux - General 5 03-10-2008 05:54 PM
cron/php/backups bitoine Linux - Newbie 2 05-05-2006 01:04 AM
cron backups kenji1903 Linux - Software 5 05-30-2004 11:04 PM
cron script backups cbeach512 Linux - Newbie 1 01-06-2004 02:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration