The Crontab issue - "All crontab jobs were replaced with blank".


Today, I got the phonecall from a colleague, he said a very serious problem happened on server - "All the crontab jobs were disappeared".

Then I asked him whether we have a backup, he said maybe not. It's very emergency!

So I logged in the server, and checked all related logs. At last, I found the cause of the problem and recovered the crontab jobs.

 

The cause:

If we typed the command 'crontab' in SSH then it was aborted by some reason ( terrible networking, application exception …… ), all crontab jobs will be replaced with blank by operating system.

It sounds crazy , but when I did the test on my VMworkstation, it really happened!

Someone faced this situation on Server today.

 

How did I recover:

Fortunately, I found a backup in a directory.

 

Reflection:

First, we should backup the crontab on all servers ASAP.

Second, we should backup the crontab every time before we edit it.

 

Some operation notes:

----------------------------------------------------------------------------

[root@server~]# last
……
user2 pts/2        111.112.113.114   Sat Jun 25 09:02 - 09:18  (00:15)
user1 pts/1        111.112.113.115      Sat Jun 25 09:00 - 09:10  (00:10)
user2 pts/0        111.112.113.114   Sat Jun 25 08:57 - 09:18  (00:20)
……

[root@server cron]# ll
……
-rw------- 1 root  root   0 Jun 25 09:18 root
……

[root@server ~]# less /var/log/secure
……
Jun 25 09:18:04 server crontab[3609]: (root) REPLACE (root)
Jun 25 09:19:01 server crond[16791]: (root) RELOAD (cron/root)
……

[root@server ~]# less /home/user2/.bash_history
……
exit
su
su
exit
exit
……

[root@server ~]# less /root/.bash_history
……
crontab
crontab -l
……

[root@server user2 ]# ll
……
-rw-r--r-- 1 root     root         10628 Jun 15 13:59 crontab.bak
……

----------------------------------------------------------------------------

  1. #1 by Kodandasai on May 22, 2016 - 4:33 am

    How can I replicate this issue.? I also faced the same problem, where all the cron entries lost. Not sure what is the reason. But in logs, I found crontab REPLACE lines.

(will not be published)

*


Fork me on GitHub