ghost CRON job continues to send emails after it is deleted?

[dtbaker]

Hello,

I am receive emails from a Scheduled Task that was created through Plesk. The email headers contain this information:

Subject: Cron <[email protected]> php /var/www/vhosts/site.net/httpdocs/cron.php
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <HOME=/var/www/vhosts/site.net>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=dtbaker>
X-Cron-Env: <USER=dtbaker>

And the content of the email is:

Could not open input file: /var/www/vhosts/site.net/httpdocs/cron.php

I have removed this job from the Scheduled Tasks area of Plesk, and running

sudo crontab -l -u dtbaker

on the server shows no scheduled tasks for dtbaker, however I continue to receive these emails (every 10 minutes - for the last month).

Can somebody help me locate this stuck/ghost cron job so I can remove it?

I have tried:

sudo service crond restart

a quick look through the "psa" database to see if I could spot scheduled tasks anywhere (I couldn't)
a

grep cron.php /var/spool/cron/* -R

brings up nothing.
re-adding and deleting the scheduled task via plesk * shrug *

Not really sure where else to look?

Cheers,
Dave

 

[Tklaversma]

Did you find any solutions to this?

I have the following problem:
1. I renamed a domain.
2. After renaming, the scheduled tasks disappeared.
3. I keep receiving mails from the scheduled tasks on the old domain name.
4. I have no idea how to delete those scheduled tasks now..

Anyone got an idea?

- - - -
Plesk 12.5.30 Update #64, last updated at April 25, 2017
CentOS Linux 7.3.1611 (Core)‬

 

[UFHH01]

Hi Tklaversma,

could you pls. tell us, WHERE you setup the scheduled task? At the subscription? At the server-wide setting ( HOME > Tools & Settings > Scheduled Tasks )?

What is the output of the commands:

/usr/local/psa/admin/sbin/crontabmng get root

and

/usr/local/psa/admin/sbin/crontabmng get DOMAIN-SPECIFIC-SYSTEM-USER

 

[Tklaversma]

I've set it up under the subscription itself..

# /usr/local/psa/admin/sbin/crontabmng get root

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/letsencrypt/scripts/renew.php'

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/ms_purge_notifications.php'

MAILTO=""
23 0,6,12,18 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/magicspam-updater.php'

MAILTO="[HIDDEN]"
0 23 * * 3 [ `date +\%d` -le 7 ] && /usr/local/bin/[HIDDEN].sh

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/rotate_logs.php'

MAILTO=""
0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/ms_clean_queue.php'

# /usr/local/psa/admin/sbin/crontabmng get DOMAIN-SPECIFIC-SYSTEM-USER

MAILTO="[HIDDEN]"
SHELL="/bin/sh"
*/5 * * * * /usr/local/psa/admin/sbin/fetch_url 'https://[HIDDEN]/subscribe/listener/process-mail-listener' > /dev/null

The cronjob is in NONE of the above... :S

 

[UFHH01]

Hi Tklaversma,

pls. inspect the header of the eMail and investigate WHICH user sends the eMail. Afterwars, pls. repeat again the suggested command with the investigated system - user.

 

[Tklaversma]

As you can see, the mail is send by the root user.

Received: by [HIDDEN].nl (Postfix, from userid 10025) id 022856000A9;
From: Cron Daemon <root@[HIDDEN]>
To: [HIDDEN]
Subject: Cron [HIDDEN] /usr/local/psa/admin/sbin/fetch_url  '[HIDDEN]' > /dev/null
Content-Type: text/plain; charset="UTF-8"
X-ASG-Orig-Subj: Cron [HIDDEN] /usr/local/psa/admin/sbin/fetch_url '[HIDDEN]' > /dev/null
Auto-Submitted: auto-generated
X-Cron-Env: <LANG=en_US.UTF-8>
X-Cron-Env: <MAILTO=[HIDDEN]>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/www/vhosts/[OLD_VHOST]>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=[OLD_NAME]>
X-Cron-Env: <USER=[OLD_USER]>

Furthermore, you wanted to see the command for the `root` user again:

# /usr/local/psa/admin/sbin/crontabmng get root

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/letsencrypt/scripts/renew.php'

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/ms_purge_notifications.php'

MAILTO=""
23 0,6,12,18 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/magicspam-updater.php'

MAILTO="[HIDDEN]"
0 23 * * 3 [ `date +\%d` -le 7 ] && /usr/local/bin/[HIDDEN].sh

MAILTO=""
0 0 * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/rotate_logs.php'

MAILTO=""
0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/psa/admin/bin/php -dauto_prepend_file=sdk.php '/usr/local/psa/admin/plib/modules/magicspam/scripts/ms_clean_queue.php'

 

[UFHH01]

Hi Tklaversma,

Received: by [HIDDEN].nl (Postfix, from userid 10025) id 022856000A9;

So the user ID is "10025". Now pls. check your file "/etc/passwd" and search for the corresponding name:

grep 10025 /etc/passwd

Afterwards, pls. repeat the above command for the corresponding username you found with "grep".


Cronjob - eMails are always sent over the root - account on your server in case of issues/errors/problems, or when you configured the scheduled task to sent eMails with each process ( optional feature! ).

 

[Tklaversma]

grep 10025 /etc/passwd

outputs nothing :S

This user does not exist anymore, since I renamed the domain > thus the user

 

[UFHH01]

Hi Tklaversma,

pls. list all files at "/var/spool/cron/crontabs":

ls -lah /var/spool/cron/crontabs

If a listed username there can't be found with the previous grep - command at your "passwd" - file, pls. delete the corresponding file.

 

[Tklaversma]

ls -lah /var/spool/cron/crontabs

outputs "No such file or directory".

cd /var/spool/cron/
ls -a

outputs different users, but not the old user that still runs the cronjob. It does show the renamed user.[/code]

It does show the `root` user. But we already know the output of that.

So from hereon you say "Delete /etc/passwd"???

 

[UFHH01]

Hi Tklaversma,

So from hereon you say "Delete /etc/passwd"???

NO, I didn't suggest that and that would be totally INCORRECT and will lead to a non - working system!!!


If ( for whate ever reason ) the corresponding crons from your "old" user doesn't exist anymore, there is nothing to do for you, expect for restarting the cron daemon or just reboot your server.

 

[Tklaversma]

I already tried both....and im still getting these mails :S

 

[UFHH01]

Hi Tklaversma,

the last option that comes in my mind, is to use a "find" command... as for example:

find / -type f -name "*.*" -exec grep --color -Hni "httpdocs/cron.php" {} \;

( pls. note, that this will take a long time for the command to be finished, depending to your hardware )​

 

[Tklaversma]

A long list that shows nothing we are looking for...
Can u explain how that it is possible i still get these mails? Is the cronjob stored in a Database?

 

[UFHH01]

Hi Tklaversma,

Is the cronjob stored in a Database?

No, it's stored as a file for your cron - daemon.

Can u explain how that it is possible i still get these mails?

The only reason that comes into my mind is, that when you renamed your domain, the existent cronjob didn't get deleted, that's why I suggested to search for the corresponding file with a "find" - command, to be sure, that there is no other place, where the cron - daemon looks for corresponding cronjobs.


Consider to expand the search, to get a more precise list, by using MORE of your previous used cronjob - command.

 

[ALAA_20]

hello, i cant delete Scheduled Task from plesk that i create with php script for the user root, any ideas thx