1

I have a weather station that sends data to a Raspberry PI, in which runs a linux server that takes that data and stores it. Everythings works fine except for one little thing. Raspberry is connected to the weather station indoor display, via usb cable. The display is set to reproduce sounds whenever it powers up. So basically, every night at 3 am I am woken up by this sound. I then connected via ssh to the Raspberry and entered this command to access log, to see what was happening at that time:

nano /var/log/syslog

And i found this line:

Jul 21 02:53:01 weatherstation CRON[25991]: (root) CMD (sudo reboot)

This repeats every day at the same time. So, apparently I have something in crontab that keeps rebooting my raspberry. Obviously it's ok if the device reboot to just chill for a moment, but it's not ok to do it at 3am lol.

I then opened:

nano /etc/crontab

And I found these 4 lines:

17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

So there is no clear sudo reboot, but I suspect that something inside /etc/cron.daily is executing that instruction. So I opened the folder cron.daily and inside I found these files:

apache2  apt-compat  aptitude  bsdmainutils  cracklib-runtime  dpkg  exim4-base  logrotate  man-db  passwd

The only file that seemed interesting for me was apt-compat. In there I found this:

# run daily job
exec /usr/lib/apt/apt.systemd.daily

The problem is, this file is too complicated for me. I don't know the programming language used inside it, and I don't know what is technically doing. So I want just to shift the reboot time from 3am to like 10am, but I can't understand how.

Thanks you all for your attention.

TechMatt
  • 13
  • 1
    Files in /etc/cron.d/ would be the place to look. Also usually you don't have system-provided stuff there, but there could be stuff in root's personal crontab too (in /var/spool/cron/crontabs/ on my Debian, or just run crontab -l as root). If all that fails, then grep -re "sudo reboot" /etc or so.) – ilkkachu Jul 21 '21 at 19:59
  • @ilkkachu Oh thank you so much, it was indeed inside /var/spool/cron/crontabs/. Thanks – TechMatt Jul 21 '21 at 20:12
  • I gather this is resolved? If so, please stop this Q&A from becoming a "zombie": Compose an answer from @ilkkachu comment and yours, then "select" it as the "accepted" answer. – Seamus Jul 21 '21 at 20:26
  • @Seamus, I'll write it as an answer – ilkkachu Jul 21 '21 at 20:26

1 Answers1

3

From the log message, we see it's run via cron (and not e.g. a systemd timer), and the command is exactly sudo reboot.

Most system-provided cron jobs would be in files within /etc/cron.d/, so that's a place to look.

Also there can be stuff in the root user's personal crontab too. The per-user crontabs should be viewed and edited with crontab -l and crontab -e, but they usually reside in /var/spool/cron/crontabs/ or some such directory. (That's the path on Debian, it might differ on other systems.) Usually, you wouldn't see system-provided stuff there, though.

Then there's /etc/cron.daily and similar directories, the files there are just executable files (usually shell scripts), which some tool runs daily/weekly/monthly. Though these might give a different sort of log entry, since they don't run directly from cron.

In a pinch, you could always fall back to grep -re "sudo reboot" /etc/ /var/ and so.

Related: Differences between `/etc/crontab`, files under `/etc/cron.d/` and `/var/spool/cron/crontabs/root`? and I think I'll just link this here too: How can I see all cron records in CentOs7

ilkkachu
  • 138,973