Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I am a new system admin, and the previous admin left no updating documentation. On more than one of my servers, a tar file is created once per day, but there is no backup job listed in my /etc/crontab file. Is there a way to figure out what script is creating these files? Help!
What distribution/version is the server running? There are several ways other then /etc/crontab. If tar file was created via a cron job it should be in the log files which should indicate how it was run. Which log file depends on the distribution.
It could be in roots crontab or /etc/cron.daily file.
You can also look in /var/spool/cron each file in there is the crontab for a specific user. You may find that there's a dedicated "backup" user that's running the job.
When I checked /var/log/cron, I found that /etc/cron.daily/makewhatis.cron runs about the same time that these tar files are being created. This is the code for makewhatis.cron. It doesn't seem like this is what would be making the tar files, unless I'm wrong on that?
#!/bin/bash
LOCKFILE=/var/lock/makewhatis.lock
# the lockfile is not meant to be perfect, it's just in case the
# two makewhatis cron scripts get run close to each other to keep
# them from stepping on each other's toes. The worst that will
# happen is that they will temporarily corrupt the database...
[ -f $LOCKFILE ] && exit 0
# if MAKEWHATISDBUPDATES variable is set to "n" or "N", then the
# update will not passed
MDU=`sed -n -e 's/^[[:blank:]]*MAKEWHATISDBUPDATES[[:blank:]]*\(.\)[[:blank:]]*$/\1/p' < /etc/man.config`
([ "$MDU" == "n" ] || [ "$MDU" == "N" ]) && exit 0
trap "{ rm -f $LOCKFILE ; exit 255; }" EXIT
touch $LOCKFILE
# Rebuild the database if makewhatis was since last full run,
# otherwise just update with new pages
if [ ! -f /var/cache/man/whatis ] ||
find /usr/sbin/makewhatis -newer /var/cache/man/whatis |grep -q .
then
makewhatis -w
else
makewhatis -U -w
fi
exit 0
for LTYPE in $TYPES; do
if [ -s "$READAHEAD_BASE/custom.$LTYPE" ]; then
FLS="$READAHEAD_BASE/custom.$LTYPE"
else
FLS=$(ls $READAHEAD_BASE/*.$LTYPE 2>/dev/null )
fi
if [ -n "$FLS" ]; then
$READAHEAD_CMD --sort --output=$READAHEAD_BASE/$LTYPE.sorted $FLS &>/dev/null
fi
done
What I was attempting to post was that none of the default scripts above should create a tar file. If there is a script in your cron.daily that is not in the above list that would be something to investigate.
About the only thing left to look at is /etc/anacrontab
Or maybe the tar file is created by a command run remotely from another server.
On my CentOS servers /etc/cron.daily is a directory, not a file, and contains several scripts that are all run at the same time each day. That seems to be the most likely place for the script you're looking for, since the tar files are created at about the same time as the makewhatis.cron script runs. Try
Code:
grep tar /etc/cron.daily/*
to see if that yields any clues.
My /etc/anacrontab just re-runs /etc/cron.daily (among other things).
Thanks to TenTenths for the lesson that user's crontabs are located in /var/spool/cron...I did not know that.
One option is to look at the timestamps of these tarballs. Are they created at a consistent time of day? If so, you can set up a script that runs around that time and records the output of "ps -ef" on a regular (fast) interval. You should be able to find the tar process that fires up around that time, and trace pids to figure out the name of the script that's calling it. From there it should be relatively easy to track it down.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.