On Wed, Jul 28, 2010 at 11:27 AM, William Bauer <[email protected]> wrote:
> I've noticed over the last couple years that with every version of
> OpenSolaris, from 2008.05 through build 134, at times my root crontab
> spontaneously deletes every line from the last comment (# symbol) and above.
> Only the lines below the last # remain. No, not just the comments disappear,
> but ALL above the last comment.
>
> These have all been clean installs, and impacts multiple computers. I have
> no explanation for when it happens--doesn't seem to be a crash or other
> non-graceful shutdown. cron just seems to blow up at very random times.
> I've had affected systems be fine for many months, then suddenly my root cron
> has one or two lines left. No one has access to my home computer, and few
> have any type of access to my work system.
>
> Very odd. I'd submit a bug, but have nothing to offer but the information in
> this message.
When I've face problems like this I've typically used a dtrace script
to see who is writing to that file. Of course, the script must be
running to catch the culprit in the act. Something along the lines of
the following is a good start. It is only a start because I've not
run this script (I typed it into the gmail web interface) and it
doesn't handle creat(), openat(), or rename() or deal with a path that
is not fully specified.
#! /usr/sbin/dtrace -wqs
syscall::open:entry,
syscall::open64:enty
/copyinstr(arg0) == "/var/spool/cron/crontabs/root"/
{
stop();
printf("%Y %s[%d] %s(%s,0%o)\n", walltimestamp, execname, pid, probefunc,
copyinstr(arg0), arg1);
system("ptree %d", pid);
system("prun %d", pid);
}
--
Mike Gerdts
http://mgerdts.blogspot.com/
_______________________________________________
sysadmin-discuss mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/sysadmin-discuss
