14 Replies Latest reply on Dec 2, 2013 11:12 AM by clementeOTN

    where is the scheduled job?

    946717

      This scheduled job starts at 22:00 every day on the Linux server.  it creates snapshot on a remote storage via ssh,  and here is what I found in the log about the job on the remote node:
      Sun Nov 10 22:00:08 EST [remote_node: rshd_0:debug]: root@a.b.c.d(linux server ip)root@a.b.c.d(ip)_37397:IN:ssh2_37397:IN:ssh2 shell:SSH INPUT COMMAND is snap create hourly_11-10-2013_22-00

       

       

      It seems root cron job is the only cron job under /var/spool/cron on this Linux server. However, I can not find the script which started at 22:00 at all, nor any script with such function. the following is the only line at 22:00pm in /var/cron/log

      Nov 10 22:01:01 phoenix crond[24352]: (root) CMD (run-parts /etc/cron.hourly)

      However, there is no any scripts with such function in /etc/cron.hourly neither.

       

      Please help me out where this schedule job possibly located on the linux server.

       

      Thank you in advance!

        • 1. Re: where is the scheduled job?
          Anar Godjaev

          Hi,

           

          Welcome to OTN form discussion:

           

          Can you please paste result :

           

          crontab -l

           

          And connect you database :  (paste result)

           

          SELECT * FROM DBA_SCHEDULER_JOB_RUN_DETAILS ';

          select * from USER_SCHEDULER_JOB_LOG ;

           

          Thank you

          • 2. Re: where is the scheduled job?
            946717

            This is not a database server, only linux.

            As I said, root has cron job, and only one. crontab -l shows root only.

            • 3. Re: where is the scheduled job?
              Dude!

              What is your Oracle Linux distribution version?

              What is the logfile name on the remote system?

              Why do you think it is a scheduled task from the /etc/cron.hourly directory?

              What do you have stored in /etc/cron.d directory?

              • 4. Re: where is the scheduled job?
                946717

                What is your Oracle Linux distribution version?

                version 6

                 

                What is the logfile name on the remote system?

                It is it's own logfile, and the name is "auditlog". the remote is a NetApp storage appliance, not a Linux server. the logfile indicates actions are instructed by this Linux server called "phoenix".

                 

                Why do you think it is a scheduled task from the /etc/cron.hourly directory?

                I am not sure what is /etc/cron.hourly all about. However, there is one entry in /var/log/cron file:
                "Nov 10 22:01:01 phoenix crond[24352]: (root) CMD (run-parts /etc/cron.hourly)",

                so, it might be indicating that a job was started by /etc/cron.hourly

                 

                What do you have stored in /etc/cron.d directory?

                nothing, empty

                 

                It looks clear that actions are initiated by the linux server, but I just don't know how the job are started and where the script is located on the linux server.

                • 5. Re: where is the scheduled job?
                  946717

                  can anybody please help me out on this case?

                  • 6. Re: where is the scheduled job?
                    Dude!

                    The directories /etc/cron.daily, /etc/cron.hourly, etc. are part of anacron and scripts put into those directories are schedule for execution as the directory name implies. It is not really difficult to find that out. You may also want check for entries in /var/spool/cron to see if cron schedules exist by other users. Based on your given information I see no evidence that your remote procedure is part of a cron schedule. I'm not familiar with NetApp or what software it installs to automate or maintain your installation, but there exists a forum at https://communities.netapp.com with users who might be more experienced with this particular type of question.

                    • 7. Re: where is the scheduled job?
                      946717

                      Understand all you are saying here.

                       

                      I have already talk to NetApp support. They are right that the action on the storage is definitely triggered by this linux server "phoenix". The following message has clearly stated that:

                       

                      Sun Nov 10 22:00:25 EST [netappname: rshd_4:debug]: root@159.3.99.146_37412:IN:ssh2 shell:SSH INPUT COMMAND is snap create vol1 vol1_nightly_11-10-2013_22-00

                       

                      159.3.99.146 is the ip for the linux server "phoenix".

                       

                      However, they can not tell me more since it should be found out on the linux.

                       

                      The problem is that I could not locate the script either by searching crontab jobs or any anacron as you explained.

                      root is only user who has cron job. I checked everysingle line, not only there are no such scripts, also there are no any jobs will ge kicked at 22:00 as the time when the action is started.

                      I also searched /etc/cron.hourly. there is only one script, and it does nothing about that action.

                       

                      so, i don't have a clue about what and where the script possible is...

                      • 8. Re: where is the scheduled job?
                        Dude!

                        Cron is not the only way to schedule a script for frequent execution. For instance, it could also a batch job that uses the at command to execute a script at a specific time, which can reschedule itself after execution. You might want to check the output of the atq command  and analyze your running processes using the ps -ef command.

                        • 9. Re: where is the scheduled job?
                          946717

                          when I tyep atq, i got the prompt right back, which means it is empty.

                           

                          I have looked cron, /etc/cron.*, and at, there are not such schedule job. It is defintely staretd by this server, due to the log on the storage. Also people here told me the job is on the server. I am new to this position.

                           

                          So, it am feel really amazed.

                          ps -ef could help, but I may not able to catch up, since it may be finished very quickly.

                           

                          can you think of any other ways/places I can check?

                          • 10. Re: where is the scheduled job?
                            946717

                            Hi,

                             

                            What is the command to list all files including a specific keywor across the entire the system?

                            I am thinking to use this way to pull out the script...

                            • 11. Re: where is the scheduled job?
                              Dude!

                              What filename are you going to search for?

                               

                              I suggest to also check /etc/rc.local and the /etc/init.d directory to see if there is anything related.

                              • 12. Re: where is the scheduled job?
                                EdStevens

                                946717 wrote:

                                 

                                Hi,

                                 

                                What is the command to list all files including a specific keywor across the entire the system?

                                I am thinking to use this way to pull out the script...

                                man find

                                • 13. Re: where is the scheduled job?
                                  user3733859

                                  I would do the following...

                                   

                                  find / -exec grep -l "string_to_search_for" {} \;

                                   

                                  this will find all files with the string "string_to_search_for" in it, regardless... this is a pretty big hammer... might take some time to do, depending on how many files/file systems you have.

                                   

                                  you can change / to a subdirectory if you like...

                                   

                                  Keith

                                  • 14. Re: where is the scheduled job?
                                    clementeOTN

                                    Hi

                                     

                                    Just one cuestion.

                                    Have you look in  /etc/crontab file ?

                                     

                                    On th eother side ....

                                    This scheduled job starts at 22:00 every day on the Linux server.  it creates snapshot on a remote storage via ssh,  and here is what I found in the log about the job on the remote node:

                                    Are you sure is "a Job"?

                                    If you don't find the script and in the /var/log/cron doesn't appears the job log, maybe it isnot a job.

                                    I think  that you are looking for  some kind of process or daemon in the netapp .

                                     

                                    Take a look to the daemons, identify them because , the most probably is that you are looking for one of them