please help....crontab file blown away

[wags1970]

is there a way to recover the crontab file in linux? The root's crontab file was accidentally deleted off a server. The backups do not pick up that particular file. I know the crontab kicked off some scripts, but now that the crontab file is gone I can't see which ones. Is there any way to recover, or any way to see the previous cron jobs that ran, so I can get an idea of how many things it was doing?

[WuNMOjTIQanXWBcH]

is there a way to recover the crontab file in linux?

The effectiveness of file recovery depends on the filesystem. Although EXT 2/3 filesystems should clean the part of the allocation tree that points to the blocks of the deleted file once a file is deleted, I recently overheard someone saying that in Linux this isnʼt actually done so there might still be hope in the case of EXT.


<OBSOLETE reason="This answer doesnʼt address the asked question">

Is there any way […] to see the previous cron jobs that ran, so I can get an idea of how many things it was doing?

Thatʼs what Iʼd do (in that order):

1. Check, if «/var/log/cron.log» exists → exists? → … → profit!
2. run «grep -R cron /var/log/*» → yields anything useful? → … → profit!
3. Also check all compressed files in «/var/log» → … → profit?
4. Check «/etc/syslog.conf» (or your equivalent) for where cron stores its log files → does cron log at all? → … → profit!
5. Iʼm in Despair!

</OBSOLETE>

[wags1970]

I do see a lot of output in the /var/log/cron file, but I don't see what I'm looking for. One file I definitely know that ran at some point overnight each night was a .pl script. I know the name of it and it still exists on the system. How do I go about finding when it ran within the cron? One good thing I have going for me at this point is the server has not been rebooted, so its my understanding that when the crontab -r command was executed, it removed it from memory, but until the server reboots it will still be there. I want to leverage this is any way to help me re-create what was taking place in the crontab.

[WuNMOjTIQanXWBcH]

I do see a lot of output in the /var/log/cron file, but I don't see what I'm looking for.

I have to apologise, I misunderstood your question as to which file was lost. Iʼm sorry.

One good thing I have going for me at this point is the server has not been rebooted, so its my understanding that when the crontab -r command was executed, it removed it from memory, but until the server reboots it will still be there.

Iʼm afraid thatʼs not the case. I just checked the open file descriptors of my cron daemons (via «/proc/$PID/fd/») and did, just as expected, not find an open descriptor for any file, just stdin, stdout and stderr (which is redirected to the logfile). The only case which I could imagine, in which the file could have been preserved, is, if «malloc()» worked extremely in your favor and didnʼt reuse any memory already «free()»ed, that was previously used to store the crontab file; but thatʼs ridiculously improbable.

[drl]

Hi.

Many people recommend PhotoRec - CGSecurity to recover files that have been deleted.

Good luck ... cheers, drl