Friday, 11 October 2013

Retrieving crontab after accidental removal

Yesterday at my workplace someone accidentally deleted all entries in crontab. We started looking for ways of restoring it as fast as possible. The tedious way of finding all processes on that machine would be our last option and it would also miss out frequency optimization done on the machine for various crons set on it.

Based on the usual Unix practice of backing up every file while saving an edit, we wanted to find out if the same happens with crontab too. To do that we needed to find out where crontab file was stored. A look at the manual page using the following command was enough to tell us that the file was stored at /var/spool/cron/.

man 8 cron

Looking in the folder, we could see the empty crontab file but no backup file was found. At this point, we did not have much hope of retrieving. Just to try our luck we tried looking at /tmp folder and fortune did favour us. We found the following file which had the previous contrab entries.

/tmp/crontab.XXXX6r0pD6

No comments: