Welcome to the MacNN Forums.

tightsocks · Sep 13, 2012, 07:53 AM

I thought cron was not used by the system anymore.
The cron process is shown by Activity Monitor as always running on my system.

P · Sep 13, 2012, 10:11 AM

Cron is not running by default, but still exists for POSIX compatibility reasons and can be activated and run as normal (using crontab).

besson3c · Sep 13, 2012, 10:31 AM

According to the cron manpage:

Quote:

The cron utility is launched by launchd(8) when it sees the existence of /etc/crontab or files in /usr/lib/cron/tabs.

tightsocks · Sep 13, 2012, 12:20 PM

So something (not the OS) is using it?
I tried to look in /usr/lib/cron/tabs/ but I don't have permission even when logged-in as an admin.
EDIT: okay, so I changed the folder's permissions and looked inside but it is empty...
Should I be concerned about this?

besson3c · Sep 13, 2012, 12:29 PM

Originally Posted by tightsocks

So something (not the OS) is using it?
I tried to look in /usr/lib/cron/tabs/ but I don't have permission even when logged-in as an admin.
EDIT: okay, so I changed the folder's permissions and looked inside but it is empty...
Should I be concerned about this?

/usr/lib/cron is a symbolic link to /var/at, and /var/at/tabs requires root to view, so you can view this directory by doing a:

sudo ls /var/at/tabs

or look at an individual tab currently installed:

sudo cat /var/at/tabs/[tabname]

Are you sure the folder is empty? It should at least have root's crontab.

tightsocks · Sep 13, 2012, 04:11 PM

Originally Posted by besson3c

Are you sure the folder is empty? It should at least have root's crontab.

Yeah, it is empty.
I looked at in it in Finder and Terminal.

P · Sep 14, 2012, 03:41 AM

Originally Posted by tightsocks

So something (not the OS) is using it?
I tried to look in /usr/lib/cron/tabs/ but I don't have permission even when logged-in as an admin.
EDIT: okay, so I changed the folder's permissions and looked inside but it is empty...
Should I be concerned about this?

Mostly curious at this point, but I wouldn't let it go just yet. What's the PPID - does it match launchd PID? What happens if you kill it (as in "killall cron". This send SIGKILL directly, Activity Monitor tries the friendlier SIGTERM first)? Did you check /etc/crontab as well?

tightsocks · Sep 14, 2012, 04:36 AM

Originally Posted by P

Mostly curious at this point, but I wouldn't let it go just yet. What's the PPID - does it match launchd PID? What happens if you kill it (as in "killall cron". This send SIGKILL directly, Activity Monitor tries the friendlier SIGTERM first)? Did you check /etc/crontab as well?

5562/width/350/height/700[/IMG]

P · Sep 14, 2012, 08:26 AM

Sorry, not sure how skilled you are at this. You did happen to find cron and at least recognize it, so you're not a total newbie.

Open a terminal window. Make it nice and wide, the default size will not cut it here. Give the command

ps -Af

This will give you a list of all processes currently running on your Mac and a bunch of information about them. Try to find the one named cron. If it becomes tricky, try piping the content to grep using

ps -Af | grep "cron"

Now look at the numbers in the beginning. The first is the user ID. 0 is root, the first regular user made is 501 (and 502 and so on if you made more), and anything else is some limited user the OS is using for security reasons. The second is the process ID (PID), and the third is the parent process ID (PPID). Look at that PPID for cron, and see if you can find that in the PID column anywhere. It should be for the launchd process if it was started normally.

While we're in the terminal anyway, go to /etc/crontabs. Anything there?

tightsocks · Sep 14, 2012, 09:59 AM

Originally Posted by P

Sorry, not sure how skilled you are at this. You did happen to find cron and at least recognize it, so you're not a total newbie.

Now look at the numbers in the beginning. The first is the user ID. 0 is root, the first regular user made is 501 (and 502 and so on if you made more), and anything else is some limited user the OS is using for security reasons. The second is the process ID (PID), and the third is the parent process ID (PPID). Look at that PPID for cron, and see if you can find that in the PID column anywhere. It should be for the launchd process if it was started normally.

UserID is 0 (root). PID is 18, PPID is 1 which seems to correspond to launchd asits Pid is listed as 1.

(interesting, it seems that this info can also be found in Activity Monitor by double-clicking on an item)

While we're in the terminal anyway, go to /etc/crontabs. Anything there?

etc/crontab
It is a 1 byte document.

Is there a way to see if there are any other crontab files hidden somewhere on the system or would they necessarily be in one of those specific locations?

besson3c · Sep 14, 2012, 10:22 AM

crontabs need to be in one of those specific locations. There are user crontabs which the instructions I gave you showed how to access, and then the system crontabs (/etc/crontab) which is what P pointed you at.

tightsocks · Sep 14, 2012, 10:42 AM

So as far as I can see there are no crontab files on my system and yet the cron process is up and running.
Is this normal for Snow Leopard?

besson3c · Sep 14, 2012, 11:10 AM

Originally Posted by tightsocks

So as far as I can see there are no crontab files on my system and yet the cron process is up and running.
Is this normal for Snow Leopard?

What does the first paragraph under "description" say when you do a "man cron" in Snow Leopard? I don't have a Snow Leopard machine handy.

Thorzdad · Sep 14, 2012, 11:39 AM

Originally Posted by besson3c

What does the first paragraph under "description" say when you do a "man cron" in Snow Leopard? I don't have a Snow Leopard machine handy.

I was passing through on my Snow Leopard, and thought I'd help out...

The cron utility is launched by launchd(8) when it sees the existence of
/etc/crontab or files in /usr/lib/cron/tabs. There should be no need to start it
manually. See /System/Library/LaunchDaemons/com.vix.cron.plist for details.

besson3c · Sep 14, 2012, 11:49 AM

So perhaps it is starting cron because /etc/crontab exists? You can try renaming this file to something else and killing cron to see if it re-spawns, but at this point if it were me I wouldn't worry about it, it isn't doing any harm.

Thorzdad · Sep 14, 2012, 11:59 AM

FWIW, on my SL iMac, cron is always running...using 0 CPU

P · Sep 14, 2012, 12:11 PM

Originally Posted by besson3c

So perhaps it is starting cron because /etc/crontab exists?

Yes, that is exactly what is happening. Launchd sees the file and triggers cron. Cron then reads the file with zero content and just idles. I suspect that somehow a cronjob was added and then removed, leaving only a single newline char in the file. If you want to stop cron launching, just delete that file. If you have reason to suspect that something has fiddled with the machine, you might want to investigate what added that cronjob - it is after all root's crontab - but it is in all likelihood benign.

besson3c · Sep 14, 2012, 01:05 PM

Originally Posted by P

Yes, that is exactly what is happening. Launchd sees the file and triggers cron. Cron then reads the file with zero content and just idles. I suspect that somehow a cronjob was added and then removed, leaving only a single newline char in the file. If you want to stop cron launching, just delete that file. If you have reason to suspect that something has fiddled with the machine, you might want to investigate what added that cronjob - it is after all root's crontab - but it is in all likelihood benign.

That file might have also just been left there by Apple, by a previous OS install, or whatever.

The reason I didn't suggest removing the file permanently is because I wasn't sure if launchd would just continuously try to re-spawn the cron daemon? If so, the cron launchd job should be stopped. But if the cron launchd job was stopped in the first place, this thread wouldn't exist, right?

But again original poster, an idle cron daemon is completely harmless.