Debian 6 Cron errors in /var/log/syslog

[Thor86]

Anyone else get these? I can't seem to pin it and didn't find anything that could be useful to resolve this issue other than apt-get updates and upgrade.

The exact error is:

/USR/SBIN/CRON[xxxx]: (CRON) error (grandchild #xxxx failed with exit status 1)

xxxx = pid

 

[Scarpozzi]

Cron runs in the background all the time, so you need to identify what's actually failing. Your best bet is to look at your logs, find out what the frequency of the failed jobs are and from that find where cron is executing the code...

For example:
If it's failing every hour on the hour, etc...you can guess the job is going to be in /etc/cron.hourly/ or in your local crontab.

If you setup something in your crontab or root's crontab, type "crontab -e" to see what's there for those users. It may take some hunting to figure out what program's causing cron to have a problem, but chances are, cron is calling a script that references a program that has been altered, upgraded, or deleted....it happens.

 

[Thor86]

Thanks for the information. The actual crontab listing shows my nmap scans of my network (using OSSEC), but this error never showed by on Debian 5, and only showed up after in-place Debian 6 upgrade.

 

[Nothinman]

Run the same command on the cli followed by 'echo $?' directly after it's done. If it's not 0 then the process is saying it's failed and that's why cron is complaining. Perhaps something changed with the 2 versions of nmap that you're using.

 

[Thor86]

Again, thanks for the information. Seems to be a memory issue, as I am running this in a virtualized environment, and the only thing I did was to trim physical memory allocation for this VM from 512mb to 384, but once I upped it back to 512, the issue seems to have gone away.

 

[Thor86]

Run the same command on the cli followed by 'echo $?' directly after it's done. If it's not 0 then the process is saying it's failed and that's why cron is complaining. Perhaps something changed with the 2 versions of nmap that you're using.

Well, spoke too soon, got the same cron error, just took a little longer.

I tried running the following cmd as you suggested:

nmap --append_output -sU -sT -oG /var/log/nmap-out.log x.x.x.x-255

echo $?

Results back zero. So all good in that front.

The crontab is setup to run every 15 mins.

 

[Nothinman]

Is that output filename static? Is it possible the previous run of nmap isn't finished before the next starts on occasion?

 

[Thor86]

Yes, filename is static and appended to. The job only takes less than 2 mins to complete, but I hear what you are saying.

I'll try renaming the current file and create a new (shorter) file to see I can duplicate the cron error.

Thanks!

 

[Thor86]

Just for closure, it seems like this was a vm over-sub issue with i/o queuing. Still testing though.