1 Periodic Processes and the cron Daemon The cron daemon is where all timed events are initiated. The cron system is serviced by the cron daemon. What to run and when to run it are specified to cron by crontab entries, which are stored in the systems cron schedule. The cron daemon wakes up every minute and examines all the stored configuration files, called crontab, to check each of them for commands that may be scheduled to be executed at the current time.

2 The cron table, crontab and file format cron table files, or crontabs, are text files which direct the cron daemon’s activities. Each one line entry in the crontab file has the following format: –minutes hours day-of-month month weekday command Spaces separate the fields. The first five fields specify the times at which cron should execute the command.

3 The crontab Entry The command crontab is used to edit, list, create or remove a crontab file. The crontab command can be used by all the users on a system to create personal crontabs as well as by root. Users are only allowed to view, edit or create their own crontab files. Additionally, the use of crontab can be denied to users. When the crontab command is invoked, it examines the files cron.deny and cron.allow to grant or revoke the modification of the crontab spool file.

crontab example 20 1 * * * root /usr/local/bin/checkit: run checkit every day at 1:20AM * * root /usr/local/bin/monthly.check: run monthly.check at 9:25am on day 17 of every month * * 7 root /usr/local/bin/Sunday.check: run sunday.check at 11:40pm every Sunday 4

5 Other tools for Automation Another way to run jobs is with the at command. The at utility reads commands from standard input and groups them together as an at-job, to be executed at a later time. at commands also use the at.allow and at.deny files to allow and deny users to create these jons. –at 0815am Jan 24 /home/alex/start_at_job

6 at vs. cron at and cron are very similar, but at performs a task only once at a specified date and time. cron performs a repetitive task on ongoing basis. Therefore "at" should be thought of as a one- time tool for use with commands needing to be executed infrequently, whereas cron should be used to schedule regular system occurrences. at is for delayed starting of one-time tasks. To repeat an at job you must re-enter the original at command. There are no provisions available in the command to make a job be performed more than once. If you need to perform a particular task on a repetitive or ongoing basis, cron is the tool of choice.

7 Tracking the System There are many tools that help the SA keep track of what is going on the system. Disk usage and filesystem status can be checked by the df and the du commands. Tracking processes can be done with the ps command. In the same way, it is possible to check who did what and when by looking at the system account and log files.

8 Syslog and Log Files A critical part of the systems administrators job is monitoring the system. Most Unix systems uses SYSLOG to do this. Syslog allows you to encode messages by level and by facility. Syslog runs as a daemon named syslogd. This daemon is generally started up in the early stages of multi-user bootup. The syslog reads it configuration info whenever it receives a HUP signal. This file is generally named /etc/syslog.conf

9 Syslog Facility Names

10 Syslog Severity Levels (Descending Severity)

11 Software that uses Syslog

12 Syslog and Log Files The syslog.conf file is a text file with the basic format of selector action where the selector is facility.level e.g.: –mail.info/var/log/maillog –*.debug/usr/adm/syslog –*.debug;kern.none/usr/adm/syslog

13 Logging Policies Log files can get pretty large. Systems can crash due to lack of space, because the log files are so large. Logging policies vary from site to site. Different schemes include: –Throwing away data immediately –Resetting log files at periodic intervals –Rotating data, keeping data for a fixed time –Compressing and archiving to tape or other permanent media

14 Some log files on your system The messages log file is the busiest of the log files. You’ll find boot time and shutdown messages here, daemons starting and stopping and more. The secure file are of particular interest from a cracker- detection point of view. This holds information about system access. The maillog files give a picture of what messages are routing though your machine. If you want to see ftp transfers to and from your machine, the information would be in the xferlog files. To find out who logged into your system and when, you need to access the wtmp file. Unlike other log files, you cannot view this file with the cat or more commands. You would need to use the last command to view this file.

15 Syslog Config Example – Network Client

16 Using Syslog from Programs – One Example One Example Example output