cron job disappearing

[LuckyLucky]

Hello

I have a drupal 8 website and I need to run the drupal cron every night at midnight
So I created a cron job into cpanel that looks like this:

wget -q https://xxxxxxxx.com/cron/xxxxxxxxxxxxxxxxxxxxxxxxxx > /dev/null 2>&1

The issue is that the crob job ends up disappearing from the cron job list after a few hours. If I go back to the cron page on cpanel, shortly after I created it, I'm likely to see it there but after a while the list becomes empty.


It used to stay there for several days and then it would trigger and do what it is supposed to do at midnight and it would disappear after a couple of days. Now it just disappears within a couple of hours.


I got our helpdesk guys to look for any memory issue but there was none. They checked the cron log and found this:

[[email protected] log]# grep DELETE cron
Apr 15 04:13:38 cpanel crontab[20456]: (user) DELETE (user)
Apr 15 06:25:35 cpanel crontab[29287]: (user) DELETE (user)
Apr 15 08:34:37 cpanel crontab[7709]: (user) DELETE (user)
Apr 15 10:08:30 cpanel crontab[10504]: (user) DELETE (user)
Apr 15 10:14:29 cpanel crontab[13327]: (user) DELETE (user)
Apr 15 12:31:52 cpanel crontab[1248]: (user) DELETE (user)
Apr 15 14:13:14 cpanel crontab[7693]: (user) DELETE (user)
Apr 15 16:40:30 cpanel crontab[30434]: (user) DELETE (user)
Apr 15 18:44:00 cpanel crontab[11894]: (user) DELETE (user)
Apr 15 20:09:37 cpanel crontab[11104]: (user) DELETE (user)
Apr 15 22:23:07 cpanel crontab[25325]: (user) DELETE (user)
Apr 16 00:21:54 cpanel crontab[31848]: (user) DELETE (user)
Apr 16 02:25:58 cpanel crontab[6815]: (user) DELETE (user)
Apr 16 04:14:00 cpanel crontab[9004]: (user) DELETE (user)
Apr 16 06:17:29 cpanel crontab[15206]: (user) DELETE (user)
Apr 16 08:20:05 cpanel crontab[22374]: (user) DELETE (user)​

But they don't have a clue of what's happening and they kind of have given up....

Any idea someone of what could be wrong?

Many thanks for your help.


LuckyLucky

 

[cPanelLauren]

Based on this output your user is logging in and deleting the cron job from the crontab. It may not be you but it is your user. I'd suggest ensuring you don't have any scripts on the account that exhibit this behavior as well as ensure that the password is not shared with anyone else.

Your provider should be able to check the cPanel access logs to determine if someone is logging in and doing this

 

[LuckyLucky]

Thanks for you answer.
It is clearly not somebody who manually deletes the job. First because the people who have access to the account know about my issue and therefore would have raised it/stop doing it. And also because this happens at random time of the day inluding in the middle of the night.

One suggestion that I received is that may be crontabs for multiple sites are using the same file and clashing? Does that make sens to you?

Thanks

 

[LuckyLucky]

I've just noticed another thing.

I had changed the email cron sends the reports to from the default user to my own email and it has reverted to the default user. email. So it's not just that the cron job disappears, it feels like the whole cron thing is resetting to default values of default user and empty list.

 

[cPanelLauren]

One suggestion that I received is that may be crontabs for multiple sites are using the same file and clashing? Does that make sens to you?

crontab is separated per user not per domain all domain's within the same account would use the same crontab so no I don't see this as being possible part of the issue.

So it's not just that the cron job disappears, it feels like the whole cron thing is resetting to default values of default user and empty list.

It could be but this isn't behavior I've seen or heard of before, your provider would need to troubleshoot this. Definitively there is an issue with your user, has your provider ensured that there isn't a compromise on your account by checking the access logs?

Ultimately, there's not a whole lot you're able to do without the provider in this instance, as they have root access to the server. Nothing cPanel does inherently would remove cron jobs unless you were manually removing them.

Something they could do might be to set up an audit rule for your user's crontab to see if any further information might be garnered, they might also try reinstalling crontab as well as resetting your actual cron configuration to rule out potentially misconfiguration (i.e., if someone had previously set something like crontab some_file_name.ext to use that file as the source which would also reset the cron to whatever is in that file). As the cPanel user though I don't think this is really anything you can do, this would be up to your provider to manage.