From: Jean-David Beyer on
Jeremy Nicoll - news posts wrote:
> Geir <geir02(a)gmail.com> wrote:
>
>> However we are unable to find the annoying script. /etc/crontab does
>> not contain any user-added stuff.
>
> I can't answer that, but would like to ask a question of my own that is
> maybe related.
>
> Is there not (or can there not be) some central syslog on a linux system
> that shows every system command that's being issued, along with things like
> its process id and the process id of the issuer if that's different?
>
> I'm thinking in terms of - say - an MVS or S/390's system log?
>
>
On my Red Hat Enterprise Linux 5 system, there is a file, /var/log/cron that
contains a log of all cron executions; e.g.,

Sep 21 01:00:01 trillian crond[22756]: (jeandavid8) CMD
(/home/jdbeyer/.sigfile )
Sep 21 01:01:01 trillian crond[22764]: (root) CMD (run-parts /etc/cron.hourly)
Sep 21 01:04:01 trillian crond[22773]: (root) CMD (run-parts /etc/cron.daily)
Sep 21 01:04:01 trillian anacron[22777]: Updated timestamp for job
`cron.daily' to 2009-09-21
Sep 21 01:05:01 trillian crond[23457]: (jeandavid8) CMD
(/home/jdbeyer/.sigfile )
Sep 21 01:10:01 trillian crond[23474]: (root) CMD (/usr/lib/sa/sa1 1 1)


--
.~. Jean-David Beyer Registered Linux User 85642.
/V\ PGP-Key: 9A2FC99A Registered Machine 241939.
/( )\ Shrewsbury, New Jersey http://counter.li.org
^^-^^ 11:20:01 up 25 days, 5:24, 4 users, load average: 4.25, 4.52, 4.46
From: John Hasler on
geir writes:
> It seems to be a certain htmlgend. I have found the file,

Where? No Debian package installs anything by that name.
--
John Hasler
jhasler(a)newsguy.com
Dancing Horse Hill
Elmwood, WI USA
From: September Storm on
Geir wrote:

> September Storm wrote:
>
>> They should be in /var/spool/cron/<usernamehere> You can grep that
>> directory's files.
>
> /var/spool/cron/crontab/root contains a line:
>
> */5 * * * * myscript
>
> which seems to me to only be run every 5 minutes. Isn't it so? There
> is no other file under /var/spool/cron
>
> However syslog and messages show a certain htmlgend which is run every
> minute. However I don't have a clue from which script this is run (I
> want to stop it :-)
>
> So what do I do?
>
> regards geir

Check your cron log to see what's running, or messages log to see if
it's from cron. I don't know what htmlgend is (never heard of it).
From: Bill Marcum on
\On 2009-09-21, Geir <geir02(a)gmail.com> wrote:
> September Storm wrote:
>
>> They should be in /var/spool/cron/<usernamehere> You can grep that
>> directory's files.
>
> /var/spool/cron/crontab/root contains a line:
>
> */5 * * * * myscript
>
> which seems to me to only be run every 5 minutes. Isn't it so? There
> is no other file under /var/spool/cron
>
> However syslog and messages show a certain htmlgend which is run every
> minute. However I don't have a clue from which script this is run (I
> want to stop it :-)
>
> So what do I do?
>
You could look for htmlgend in the output of pstree. It might be running
from a script in an endless "while sleep 60" loop, or from inetd in response
to some external host.

From: The Natural Philosopher on
Jeremy Nicoll - news posts wrote:
> Geir <geir02(a)gmail.com> wrote:
>
>> However we are unable to find the annoying script. /etc/crontab does
>> not contain any user-added stuff.
>
> I can't answer that, but would like to ask a question of my own that is
> maybe related.
>
> Is there not (or can there not be) some central syslog on a linux system
> that shows every system command that's being issued, along with things like
> its process id and the process id of the issuer if that's different?
>
> I'm thinking in terms of - say - an MVS or S/390's system log?
>
>
ps?