How to recover deleted crontab
I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?
Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?
centos cron scheduling
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
|
show 2 more comments
I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?
Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?
centos cron scheduling
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
1
Stuff like this is one reason why I useetckeeper.
– David Foerster
Dec 1 '17 at 11:44
2
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27
|
show 2 more comments
I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?
Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?
centos cron scheduling
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?
Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?
centos cron scheduling
centos cron scheduling
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
edited 3 mins ago
Rui F Ribeiro
39.2k1479130
39.2k1479130
asked Dec 1 '17 at 9:20
BlunT
19216
asked Dec 1 '17 at 9:20
BlunT
19216
asked Dec 1 '17 at 9:20
BlunT
19216
19216
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
1
Stuff like this is one reason why I useetckeeper.
– David Foerster
Dec 1 '17 at 11:44
2
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27
|
show 2 more comments
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
1
Stuff like this is one reason why I useetckeeper.
– David Foerster
Dec 1 '17 at 11:44
2
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
1
1
Stuff like this is one reason why I use
etckeeper.– David Foerster
Dec 1 '17 at 11:44
Stuff like this is one reason why I use
etckeeper.– David Foerster
Dec 1 '17 at 11:44
2
2
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27
|
show 2 more comments
3 Answers
3
active
oldest
votes
You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.
You do not have any recovery option other than third party recovery tools.
edited Dec 1 '17 at 11:55
David Foerster
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Usegrepwith either-oor piped intosed/awk/cut/etc to extract just the command, and then piped intosort -u.
– Patrick
Dec 1 '17 at 13:31
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something likeawk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8will show the entries forusernamesorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.
– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
|
show 1 more comment
I am not sure, it is possible to recover crontab file without backup.
But, I am pretty sure you can restore your crontab file from cron logs.
As far as I remember, fast every command is listed there with user.
answered Dec 1 '17 at 9:28
xulsitatirev
50917
add a comment |
If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it.
This works for any file.
grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected
Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file.
The -a parameter is needed to force grep to consider your device as text.
You will then have to clean the binary mess before and after your data in the resulting file.
And it takes a lot of time. Good luck.
You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange
edited Mar 4 '18 at 10:24
Drakonoved
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f408154%2fhow-to-recover-deleted-crontab%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.
You do not have any recovery option other than third party recovery tools.
edited Dec 1 '17 at 11:55
David Foerster
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Usegrepwith either-oor piped intosed/awk/cut/etc to extract just the command, and then piped intosort -u.
– Patrick
Dec 1 '17 at 13:31
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something likeawk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8will show the entries forusernamesorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.
– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
|
show 1 more comment
You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.
You do not have any recovery option other than third party recovery tools.
edited Dec 1 '17 at 11:55
David Foerster
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Usegrepwith either-oor piped intosed/awk/cut/etc to extract just the command, and then piped intosort -u.
– Patrick
Dec 1 '17 at 13:31
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something likeawk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8will show the entries forusernamesorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.
– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
|
show 1 more comment
You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.
You do not have any recovery option other than third party recovery tools.
edited Dec 1 '17 at 11:55
David Foerster
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.
You do not have any recovery option other than third party recovery tools.
edited Dec 1 '17 at 11:55
David Foerster
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
edited Dec 1 '17 at 11:55
David Foerster
951616
edited Dec 1 '17 at 11:55
David Foerster
951616
edited Dec 1 '17 at 11:55
David Foerster
951616
951616
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
answered Dec 1 '17 at 9:29
Muhammed Sherief
963
963
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Usegrepwith either-oor piped intosed/awk/cut/etc to extract just the command, and then piped intosort -u.
– Patrick
Dec 1 '17 at 13:31
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something likeawk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8will show the entries forusernamesorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.
– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
|
show 1 more comment
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Usegrepwith either-oor piped intosed/awk/cut/etc to extract just the command, and then piped intosort -u.
– Patrick
Dec 1 '17 at 13:31
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something likeawk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8will show the entries forusernamesorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.
– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running?
– BlunT
Dec 1 '17 at 9:53
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
I think you have to go line by line for last one month. Sorry
– Muhammed Sherief
Dec 1 '17 at 11:29
No need for "line by line". Use
grep with either -o or piped into sed/awk/cut/etc to extract just the command, and then piped into sort -u.– Patrick
Dec 1 '17 at 13:31
No need for "line by line". Use
grep with either -o or piped into sed/awk/cut/etc to extract just the command, and then piped into sort -u.– Patrick
Dec 1 '17 at 13:31
2
2
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something like
awk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8 will show the entries for username sorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.– James Sneeringer
Dec 1 '17 at 14:28
You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something like
awk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8 will show the entries for username sorted by command, which should make it easier to see the intervals between them so you can recreate their schedules.– James Sneeringer
Dec 1 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
@JamesSneeringer that is definitely witchcraft! thumbs up for that!
– BlunT
Dec 1 '17 at 15:42
|
show 1 more comment
I am not sure, it is possible to recover crontab file without backup.
But, I am pretty sure you can restore your crontab file from cron logs.
As far as I remember, fast every command is listed there with user.
answered Dec 1 '17 at 9:28
xulsitatirev
50917
add a comment |
I am not sure, it is possible to recover crontab file without backup.
But, I am pretty sure you can restore your crontab file from cron logs.
As far as I remember, fast every command is listed there with user.
answered Dec 1 '17 at 9:28
xulsitatirev
50917
add a comment |
I am not sure, it is possible to recover crontab file without backup.
But, I am pretty sure you can restore your crontab file from cron logs.
As far as I remember, fast every command is listed there with user.
answered Dec 1 '17 at 9:28
xulsitatirev
50917
I am not sure, it is possible to recover crontab file without backup.
But, I am pretty sure you can restore your crontab file from cron logs.
As far as I remember, fast every command is listed there with user.
answered Dec 1 '17 at 9:28
xulsitatirev
50917
answered Dec 1 '17 at 9:28
xulsitatirev
50917
answered Dec 1 '17 at 9:28
xulsitatirev
50917
answered Dec 1 '17 at 9:28
xulsitatirev
50917
50917
add a comment |
add a comment |
If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it.
This works for any file.
grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected
Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file.
The -a parameter is needed to force grep to consider your device as text.
You will then have to clean the binary mess before and after your data in the resulting file.
And it takes a lot of time. Good luck.
You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange
edited Mar 4 '18 at 10:24
Drakonoved
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
add a comment |
If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it.
This works for any file.
grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected
Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file.
The -a parameter is needed to force grep to consider your device as text.
You will then have to clean the binary mess before and after your data in the resulting file.
And it takes a lot of time. Good luck.
You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange
edited Mar 4 '18 at 10:24
Drakonoved
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
add a comment |
If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it.
This works for any file.
grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected
Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file.
The -a parameter is needed to force grep to consider your device as text.
You will then have to clean the binary mess before and after your data in the resulting file.
And it takes a lot of time. Good luck.
You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange
edited Mar 4 '18 at 10:24
Drakonoved
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it.
This works for any file.
grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected
Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file.
The -a parameter is needed to force grep to consider your device as text.
You will then have to clean the binary mess before and after your data in the resulting file.
And it takes a lot of time. Good luck.
You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange
edited Mar 4 '18 at 10:24
Drakonoved
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
edited Mar 4 '18 at 10:24
Drakonoved
7091520
edited Mar 4 '18 at 10:24
Drakonoved
7091520
edited Mar 4 '18 at 10:24
Drakonoved
7091520
7091520
answered Dec 1 '17 at 14:50
Hexdump
763
answered Dec 1 '17 at 14:50
Hexdump
763
answered Dec 1 '17 at 14:50
Hexdump
763
763
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f408154%2fhow-to-recover-deleted-crontab%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation.
– Raman Sailopal
Dec 1 '17 at 9:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)...
– BlunT
Dec 1 '17 at 9:49
1
Stuff like this is one reason why I use
etckeeper.– David Foerster
Dec 1 '17 at 11:44
2
Restore it from backup
– PiedPiper
Dec 1 '17 at 12:24
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab.
– BlunT
Dec 1 '17 at 12:27