Cacti (home)ForumsDocumentation
Cacti: offical forums and support
It is currently Tue Jun 25, 2019 11:01 am

All times are UTC - 5 hours




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Wed Nov 28, 2018 6:06 pm 
Offline
Cacti User

Joined: Fri Nov 09, 2012 5:14 am
Posts: 75
Hi,

It's been a few years since I posted on here. Recently I decided to uninstall cacti from my home ubuntu server, following an upgrade to 18.04 ( a few months ago)

I've noticed in my syslog that a cacti cronjob runs every 5 mins or so:

Nov 28 22:45:01 MEDIASERVER CRON[10505]: (www-data) CMD (php /opt/cacti/poller.php > /dev/null 2>&1)
Nov 28 22:50:01 MEDIASERVER CRON[10843]: (www-data) CMD (php /opt/cacti/poller.php > /dev/null 2>&1)
Nov 28 22:55:01 MEDIASERVER CRON[11583]: (www-data) CMD (php /opt/cacti/poller.php > /dev/null 2>&1)
Nov 28 23:00:01 MEDIASERVER CRON[11834]: (www-data) CMD (php /opt/cacti/poller.php > /dev/null 2>&1)

But there isn't any cronjobs for the user www-data

[email protected]:/var/log$ sudo crontab -l -u www-data
no crontab for www-data

Can anyone help in trying to track down this cronjob and delete it?

I used the script as detailed here: https://stackoverflow.com/questions/134 ... -all-users
and got the following output with the suspect line at the bottom...

[email protected]:~$ ./cron.sh
mi h d m w user command
09,39 * * * * root [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi
25 6 * * * root /etc/cron.daily/0anacron
25 6 * * * root /etc/cron.daily/apache2
25 6 * * * root /etc/cron.daily/apport
25 6 * * * root /etc/cron.daily/apt-compat
25 6 * * * root /etc/cron.daily/apt-show-versions
25 6 * * * root /etc/cron.daily/bsdmainutils
25 6 * * * root /etc/cron.daily/cracklib-runtime
25 6 * * * root /etc/cron.daily/dpkg
25 6 * * * root /etc/cron.daily/logrotate
25 6 * * * root /etc/cron.daily/man-db
25 6 * * * root /etc/cron.daily/mdadm
25 6 * * * root /etc/cron.daily/mlocate
25 6 * * * root /etc/cron.daily/passwd
25 6 * * * root /etc/cron.daily/popularity-contest
25 6 * * * root /etc/cron.daily/samba
25 6 * * * root /etc/cron.daily/ubuntu-advantage-tools
25 6 * * * root /etc/cron.daily/update-notifier-common
25 6 * * * root /etc/cron.daily/upstart
30 7 * * * root [ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi
45 21 * * * root test -x /etc/cron.daily/popularity-contest && /etc/cron.daily/popularity-contest --crond
47 6 * * 7 root /etc/cron.weekly/0anacron
47 6 * * 7 root /etc/cron.weekly/man-db
47 6 * * 7 root /etc/cron.weekly/update-notifier-common
52 6 1 * * root /etc/cron.monthly/0anacron
*/5 * * * * www-data php /opt/cacti/poller.php > /dev/null 2>&1

Can anyone help in trying to track down this cronjob and delete it?


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Wed Nov 28, 2018 6:44 pm 
Offline
Cacti User

Joined: Mon Apr 09, 2018 1:37 pm
Posts: 86
Have you visually looked in /var/spool/cron/crontabs?


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Thu Nov 29, 2018 3:17 am 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 2523
Check /etc/cron.d

_________________
Official Cacti Developer

Cacti Resources:
Cacti Website (including releases)
Cacti Issues
Cacti Development Releases
Cacti Development Documentation

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Thu Nov 29, 2018 4:26 am 
Offline
Cacti User

Joined: Fri Nov 09, 2012 5:14 am
Posts: 75
mmccaugh wrote:
Have you visually looked in /var/spool/cron/crontabs?


[email protected]:~# cd /var/spool/cron/crontabs/

[email protected]:/var/spool/cron/crontabs# ll
total 12
drwx-wx--T 2 root crontab 4096 Nov 28 22:30 ./
drwxr-xr-x 3 root root 4096 Apr 20 2016 ../
-rw------- 1 root crontab 1090 Nov 28 22:30 root

[email protected]:/var/spool/cron/crontabs# more root
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.BLFFW0/crontab installed on Wed Nov 28 22:30:26 2018)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)

# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
#
# For more information see the manual pages of crontab(5) and cron(8)
#
# m h dom mon dow command


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Thu Nov 29, 2018 4:27 am 
Offline
Cacti User

Joined: Fri Nov 09, 2012 5:14 am
Posts: 75
netniV wrote:
Check /etc/cron.d


[email protected]:/var/spool/cron/crontabs# cd /etc/cron.d

[email protected]:/etc/cron.d# ll
total 36
drwxr-xr-x 2 root root 4096 Nov 5 08:15 ./
drwxr-xr-x 158 root root 12288 Nov 29 09:23 ../
-rw-r--r-- 1 root root 285 May 29 2017 anacron
-rw-r--r-- 1 root root 589 Jul 16 2014 mdadm
-rw-r--r-- 1 root root 712 Jan 17 2018 php
-rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder
-rw-r--r-- 1 root root 191 May 1 2016 popularity-contest


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Thu Nov 29, 2018 5:00 am 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 2523
Did you win? (just joking about the popularity contest ;-))

Try crontab -l cactiuser or crontab -l cacti

_________________
Official Cacti Developer

Cacti Resources:
Cacti Website (including releases)
Cacti Issues
Cacti Development Releases
Cacti Development Documentation

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Thu Nov 29, 2018 9:51 am 
Offline
Cacti User

Joined: Mon Apr 09, 2018 1:37 pm
Posts: 86
Also can you confirm which script you ran (The cron.sh) there were many scripts or commands at the link you posted, and honestly I didn't want to read them all to determine which would produce the output you posted.

How what you posted was generated should show where this was found.

Also just a dumb question, but have you rebooted? Not that it SHOULD be necessary, but I have seen things get stuck in memory before (Albeit on much older Unix/Xenix systems, not so much on newer kernels)


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Fri Nov 30, 2018 6:56 am 
Offline
Cacti User

Joined: Fri Nov 09, 2012 5:14 am
Posts: 75
Quote:
Did you win? (just joking about the popularity contest ;-))

Try crontab -l cactiuser or crontab -l cacti


it's the first time i've 'won' something in a while :)

those users don't exist...


Quote:
Also can you confirm which script you ran (The cron.sh)


The script I ran was:

Code:
#!/bin/bash

# System-wide crontab file and cron job directory. Change these for your system.
CRONTAB='/etc/crontab'
CRONDIR='/etc/cron.d'

# Single tab character. Annoyingly necessary.
tab=$(echo -en "\t")

# Given a stream of crontab lines, exclude non-cron job lines, replace
# whitespace characters with a single space, and remove any spaces from the
# beginning of each line.
function clean_cron_lines() {
    while read line ; do
        echo "${line}" |
            egrep --invert-match '^($|\s*#|\s*[[:alnum:]_]+=)' |
            sed --regexp-extended "s/\s+/ /g" |
            sed --regexp-extended "s/^ //"
    done;
}

# Given a stream of cleaned crontab lines, echo any that don't include the
# run-parts command, and for those that do, show each job file in the run-parts
# directory as if it were scheduled explicitly.
function lookup_run_parts() {
    while read line ; do
        match=$(echo "${line}" | egrep -o 'run-parts (-{1,2}\S+ )*\S+')

        if [[ -z "${match}" ]] ; then
            echo "${line}"
        else
            cron_fields=$(echo "${line}" | cut -f1-6 -d' ')
            cron_job_dir=$(echo  "${match}" | awk '{print $NF}')

            if [[ -d "${cron_job_dir}" ]] ; then
                for cron_job_file in "${cron_job_dir}"/* ; do  # */ <not a comment>
                    [[ -f "${cron_job_file}" ]] && echo "${cron_fields} ${cron_job_file}"
                done
            fi
        fi
    done;
}

# Temporary file for crontab lines.
temp=$(mktemp) || exit 1

# Add all of the jobs from the system-wide crontab file.
cat "${CRONTAB}" | clean_cron_lines | lookup_run_parts >"${temp}"

# Add all of the jobs from the system-wide cron directory.
cat "${CRONDIR}"/* | clean_cron_lines >>"${temp}"  # */ <not a comment>

# Add each user's crontab (if it exists). Insert the user's name between the
# five time fields and the command.
while read user ; do
    crontab -l -u "${user}" 2>/dev/null |
        clean_cron_lines |
        sed --regexp-extended "s/^((\S+ +){5})(.+)$/\1${user} \3/" >>"${temp}"
done < <(cut --fields=1 --delimiter=: /etc/passwd)

# Output the collected crontab lines. Replace the single spaces between the
# fields with tab characters, sort the lines by hour and minute, insert the
# header line, and format the results as a table.
cat "${temp}" |
    sed --regexp-extended "s/^(\S+) +(\S+) +(\S+) +(\S+) +(\S+) +(\S+) +(.*)$/\1\t\2\t\3\t\4\t\5\t\6\t\7/" |
    sort --numeric-sort --field-separator="${tab}" --key=2,1 |
    sed "1i\mi\th\td\tm\tw\tuser\tcommand" |
    column -s"${tab}" -t

rm --force "${temp}"


Quote:
have you rebooted?


yeah - the server has been rebooted...


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Fri Nov 30, 2018 7:17 am 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 2523
So, cron is very simplistic in how it works. If you use
Code:
man cron
it will tell you all the places it looks for files. I would suggest manually looking through those files rather than relying on a script. Additionally, if you have used crontab, then you should also check the manual for that. Different OS's place the files in slightly different places but most are the same.

On ubuntu, that would be:
Quote:
/var/spool/cron/crontabs
/etc/crontab
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly
/etc/cron.d


There is also a file in /etc/default/ but I don't think it would be put in there.

As a last resort, you could write a small PHP script to call "pstree -s <pid>" where pid is the PHP process ID, and this should show you were the script is being called from to make sure it is cron that's spawning the command.

_________________
Official Cacti Developer

Cacti Resources:
Cacti Website (including releases)
Cacti Issues
Cacti Development Releases
Cacti Development Documentation

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Fri Nov 30, 2018 7:30 am 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 2523
On and if you tag a -u on the end of pstree, it'll tell you when it changes users too.

_________________
Official Cacti Developer

Cacti Resources:
Cacti Website (including releases)
Cacti Issues
Cacti Development Releases
Cacti Development Documentation

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Mon Dec 03, 2018 1:03 pm 
Offline
Cacti User

Joined: Mon Apr 09, 2018 1:37 pm
Posts: 86
At the top of your cron.sh script, just after #!/bin/bash

Add the line 'set -x'

Code:
#!/bin/bash

set -x
# System-wide crontab file and cron job directory. Change these for your system.
CRONTAB='/etc/crontab'
CRONDIR='/etc/cron.d'


So your code will look like this (Plus obviously the rest of the script)

That will generate a SHITLOAD of output as it will make the shell script echo everything is is doing to the screen. But you will probably see where it is finding this in the output.

I suggest "cron.sh >/tmp/cronscript.txt 2>&1" which will send all your output to /tmp/cronscript.txt then just grep that file for www-data

Net is also right though, Cron isn't super complex and there are a finite number of places it can store anything.. So you will probably find it if you check the directories he listed.


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Tue Dec 11, 2018 2:14 pm 
Offline
Cacti User

Joined: Mon Apr 09, 2018 1:37 pm
Posts: 86
Did this ever get figured out?

I'm a bit curious where the crontab was lurking!


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Fri Dec 14, 2018 9:33 am 
Offline
Cacti User

Joined: Fri Nov 09, 2012 5:14 am
Posts: 75
yesh - it was in the /etc/crontab file... :oops:


Top
 Profile  
 
 Post subject: Re: Uninstalled Cacti on Ubuntu but cron job still present
PostPosted: Mon Dec 17, 2018 5:31 pm 
Offline
Cacti User

Joined: Mon Apr 09, 2018 1:37 pm
Posts: 86
villieb wrote:
yesh - it was in the /etc/crontab file... :oops:


Happens to the best of us!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours


Who is online

Users browsing this forum: No registered users and 15 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  

Protected by Anti-Spam ACP Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group