Home > Computer, System & Shell > How to restore crontab entries from scratch after accidentally typing ‘crontab -r’

How to restore crontab entries from scratch after accidentally typing ‘crontab -r’

What happens if you type crontab -r instead of crontab -e ? Well, your crontab gets immediately deleted, without any further confirmation request. That is sub-optimal, especially because ‘r’ lays next to ‘e’, which is frequently used for editing the crontab (I really would appreciate it if crontab -r would ask the user, while crontab -R would not ask).

The first thing to try to undo the mistake, is to check whether there are some backups of the previously installed crontab (e.g. in /etc/cron* or some system-dependent backup) and then reinstall these.

If this is not the case (as usual), then there is no other way than creating a new crontab. But how do we know which entries were defined in it before deleting? Here, the system logs in /var/logs/ help us a lot, since it stores all crontab-calls of the long past and makes them easily to extract, since “/usr/sbin/cron” is part of the message (possibly in upper-case!). So, depending on your system, cat and grep all crontab lines from the messages* files into some output file, e.g.,

cat /var/logs/messages | grep -i "`which cron`" > /tmp/cron

where `which cron` is used to automatically be replaced by for example /usr/sbin/cron, depending on your system. You should also append all data from older messages, as usually stored as .gz or .bz archive. For .gz you might use:

gzip -d /var/logs/messages*.gz -c | grep -i "`which cron`" >> /tmp/cron

Now /tmp/cron is a file that contains all crontab-calls. You might use the less command to display its entries. Choose any line to handle at first, and Copy&Paste its <command> call (where <command> denotes the stuff in the bracktes after ‘CMD’) to a new textfile in which you rebuild your new crontab. To get the time interval for this command call, use the search function and have a look at the date/time when this call is repeated. Using less, just type /<command>, this will highlight all occurences. So, once you have extracted this call and recreated it using the appropriate * * * * * <command> syntax, you might delete all its occurences from /tmp/cron. You might do this by

cat /tmp/cron | grep -v "<command>" > /tmp/cron.out; mv /tmp/cron.out /tmp/cron

By repeating these steps, the file /tmp/cron gets smaller and smaller and you finally can be sure to have all crontab-calls handled that were made in the past since the first log entry.

Furthermore, since the file /tmp/cron decreases quite rapidly over time (there might be thousands of lines for just 10 crontab commands or so), you get the feeling to make progress, so its not that awful anymore that you called crontab -r before 🙂

After installing the newly created crontab, you should call the following command to manually backup your crontab:

crontab -l > ~/crontab.bak

Hopefully, this helps some of you out there that are in the same problematic situation…

Advertisements
  1. Ram Mohan K
    July 4, 2014 at 7:12 am

    Thanks a lot for the article

  2. July 8, 2014 at 11:09 am

    Hm… I don’t know if you can solve it like this. But it is worth of try!

  3. October 1, 2014 at 11:30 am

    Hey there! Do you know if they make any plugins to safeguard against hackers?
    I’m kinda paranoid about losing everything I’ve worked hard on. Any recommendations?

    • October 2, 2014 at 8:58 am

      If a hacker is able to edit your crontab, then he/she can do basically everything that you can do.
      So the only answer is: backup all data from time to time on another machine, including a backup of your crontab if it contains anything special by crontab -l > ~/crontab.bak

  4. nothing
    December 10, 2014 at 1:44 pm

    You can check /tmp folder, it contains last edited files.

  5. June 10, 2015 at 12:13 pm

    Thanks a lot for this, very good idea of reconstructing crontab based on the log.

  6. Dipesh
    June 23, 2015 at 12:37 pm

    Very easy vi /var/spool/cron/*user* or /var/spool/cron/root

  7. May 12, 2016 at 3:11 pm

    For anyone who wants a cron job which backs up your crontab, storing a new version every time it changes, try this:

    08 03 * * * crontab -l > ~/backup/crontabs/$(crontab -l | sha1sum | awk ‘BEGIN{FS=” “} {print $1}’).cron

    this will run at 03:08 every morning.

    You’ll have to create the backup/crontabs/ directory like this:

    mkdir -p ~/backup/crontabs/

    Should you ever need to restore, use the newest file found there and mend your crontab with it.

  8. Marcus
    April 26, 2017 at 8:37 pm

    Thanks. Do you now if there is a patch for crontab to ask before deleting ?

  9. CSliv
    September 12, 2017 at 3:07 pm

    Maybe something to rename the old crontab rather than deleting it so my employees new to this don’t destroy everything.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: