[SLUG] Cron's

[Gavin Baker]

On Thu, 23 Jan 2003 17:03:01 +0000
Al Girling <al21 at firenet.uk.com> wrote:

> Last night Jamie and I briefly discussed our ever increasing
> /var/log/messages files.  I had a proper look at mine today.  it seems
> I have one particular message which is made every minute.  (Guaranteed
> to fill log files that!)  The message in question is;
> 
> 'Jan 23 16:33:00 localhost CROND[2575]: (mail) CMD (/usr/bin/python -S
> 
> /var/lib/mailman/cron/qrunner)'

Your /etc/syslog.conf is probably set up to send all messages from cron
and mail to /var/log/messages. Debian has something like

 *.=info;*.=notice;*.=warn;\
        cron, mail          -/var/log/messages

Which says to send any syslog messages of priority info, notice or warn
from the cron or mail facility to the /var/log/messages file. (see
syslog.conf(5) for the config syntax and syslog(3) for an explanation of
the priority levels and facilities, both are pretty simple)


The message from cron every minute is due to a cron job that executes
the /var/lib/mailman/cron/qrunner script every minute. No suprises :)

Check /etc/cron.d/* for this cron job.

> Looking at man pages led me to; # less /var/spool/cron/mail 

/var/spool/cron/* is cron's internal playground, changes to these won't
be kept over cron restarts as they will be reinstalled from /etc/cron*.

> In which I find;
> 
> # Retry failed deliveries once per minute.
> * * * * * /usr/bin/python -S /var/lib/mailman/cron/qrunner
> 
> Which would seem to me, to be the culprit!  I'd now like to know how I
> can stop this?  I'm tempted to simply comment out the `* * * * *
> /usr/bin/python -S' line with a #, temporaraly, which might stop the
> cycle of events.  But doesn't tell me why it started.  

You could just comment out the job (in it's /etc/cron* script), or you
could just change the times that it is run. For example, changing  * * *
* * to 0,15,30,45 * * * *, would only run that cronjob every 15 minutes.
Check crontab(5) for file syntax.

> I can't see from the log which failed delivery started all this, is
> there any other way I can tell?

There may not be any failed deliveries (if I'm reading this right). That
script may just be checking in case there *are* any failed deliveries
that need to be retried.

It looks like the messages are from "mailman", the server that handles
mailing lists like SLUG. Check if it's installed (rpm -qa | grep
mailman), if it is, you will probably want to just remove it (rpm -e
mailman) or check it's homepage for docs :)

> Can anyone give me a clue about what's really going on or where I
> should be looking?
> 
> I'm sure Jamie might be interested.  Last night he said his
> /var/log/messages file was over 22Mb.  ;)

That really is quite large. The box here that handles mail (fetched from
4 POP servers, and directly delivered mail), which has exim, spamassasin
and a mail virus scanner, that all are pretty verbose in their logging
has: 

za at fluffy:~$ ls -lhS /var/log/messages*
-rw-r-----    1 root     adm   203K Jan 25 21:40 /var/log/messages
-rw-r-----    1 root     adm    99K Jan 19 06:47 /var/log/messages.0
-rw-r-----    1 root     adm    18K Dec 29 06:29 /var/log/messages.3.gz
-rw-r-----    1 root     adm    12K Jan 12 06:47 /var/log/messages.1.gz
-rw-r-----    1 root     adm   7.2K Jan  5 06:47 /var/log/messages.2.gz

(My firewall log for today, with 755 log lines is only 164K)
 
You have logrotate installed right?
 
> P.S.  and yes! I've been looking at 'logrotate' to help clear my log
> files. ;)

ah :)

Hope that helps a little,
Gav