Help, ghost cronjob

[Duboux]

I once wrote a script to update a MySql table and set it as a cronjob to run every 10minutes, on a user account.
Then I did an admin-backup on the user, to move him to his own server, and I removed the user from the old server.
When the script needed adjusting, I adjusted it, and ever since there has been trouble with the database table not being updated according to the new script.

When I removed allll the user-cronjobs and even the script, I found out that somehow the old script is still running every 10mins...

But there's no Cron-log on it, and there's no httpd-log on it.
The crons and crontab are all empty (that is, the old script isn't in there)

The mysql log shows me it still runs the old scripts queries.
Searching within all the user-files on a bit of the query, resulted in no findings (after I removed the adjusted script)
MyTop doesn't tell me anything.
top doesn't show me the source.
SHOWPROCESSLIST shows me the PID of one of the queries (the script contains like 100 small queries), but when I try to # ps it, I'm too late, lol

I've even cleared the memory with: # sync; echo 3 > /proc/sys/vm/drop_caches
thinking, since linux has to run it quite often it might have placed it in it's memory.

I've restarted MySql, I've restarted crontab...


Nothing worked


Any ideas ?

Thanks

 

[daveyw]

Try one of those commands

crontab -u [B]username[/B] -l

nano -w /etc/crontab

nano -w /var/log/cron

otherwise check at directadmin if there is a cronjob added.

 

[tillo]

This might be one of the strangest thing I ever read about a linux system.
There are no things like ghost cronjobs: if there is no log line about it, it means that cron is not running it.
There are another ways to run a script every 10 minutes, for example with a virtual cron function within a website. Many CMS and forum distributions do it, they check the date of the last check and if they have done it more than 10 minutes before they run the given script or a specific function.

If you know which query is being runned just search for it with grep.

 

[Duboux]

Try one of those commands

crontab -u [B]username[/B] -l

Only shows the users other crons.
None of them run every 10mins..
15 */3 * * * /usr/local/bin/php -q -f /home/*****/domains/*****.com/*****.php >/dev/null
40 4 * * * /usr/local/bin/php -q -f /home/*****/domains/*****.com/*****.php >/dev/null

nano -w /etc/crontab

[root@server ~]# cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

nano -w /var/log/cron

The cron-lines around every */10 time are:
May 9 22:10:01 server crond[26084]: (root) CMD (/usr/local/directadmin/dataskq)
May 9 22:10:01 server crond[26085]: (root) CMD (/usr/bin/test -e /etc/csf/lfd.enable && /bin/rm /etc/csf/lfd.enable && /usr/sbin/csf -e > /dev/null 2>&1)
May 9 22:10:01 server crond[26088]: (root) CMD (/usr/bin/test -e /etc/csf/lfd.start && /bin/rm /etc/csf/lfd.start && /etc/init.d/lfd start > /dev/null 2>&1)
May 9 22:10:02 server crond[26092]: (root) CMD (/usr/bin/test -e /etc/csf/lfd.restart && /bin/rm /etc/csf/lfd.restart && /etc/init.d/lfd restart > /dev/null 2>&1)
(which run every minute, so no trace of anything else)

otherwise check at directadmin if there is a cronjob added.

How do you mean ?

 

[Duboux]

OMG

O M G

DA support suggested I'd check remote scripts...
Then it hit me... "there might still be crons running on the old server"
And with the moving from servers, I changed the database settings in the scripts on the old server, changing the host pointing to the new server.
So I removed the old servers IP from the MySql access hosts on the new server, and the database didn't change anymore every 10mins

I thought I removed the user on the old server, so I did "crontab -u username -l" on the old server, and there it was...
I checked for the user, and it was still there..
I thought I removed it, but it still existed..




That explains why I couldn't find anything but the query logs..
As the script addressing them was on a different server.

 

[tillo]

So it was a ghost cron, from another dimension! This is just so funny.

 

[daveyw]

Duboux, stop with drinking alcohol when you are busy with the servers
Anyways, nice that its fixed now