cron problem

[morraine]

Hi when i view my /var/log/syslog over SSH it is telling me that its running this cron :
(/var/www/clients/client1/web2/cd /var/www/clients/client1/web2/web/qweiugbzsq86ts2po/sugar2; php -f cron.php > /dev/null 2>&1)

but i have deleted this cron from ispconfig yesterday but it seams to be still running it even though its nowhere to be seen in ispconfig or the cron tab
where could i view this if its not in ispconfig and how do i repair this problem

Sep 21 11:12:01 loft7403 /USR/SBIN/CRON[10138]: (web2) CMD (/var/www/clients/client1/web2/cd /var/www/clients/client1/web2/web/qweiugbzsq86ts2po/sugar2; php -f cron.php > /dev/null 2>&1)
Sep 21 11:12:01 loft7403 /USR/SBIN/CRON[10139]: (root) CMD (/usr/local/ispconfig/server/server.sh > /dev/null 2>> /var/log/ispconfig/cron.log)
Sep 21 11:12:01 loft7403 /USR/SBIN/CRON[10136]: (CRON) error (grandchild #10138 failed with exit status 1)
Sep 21 11:13:01 loft7403 /USR/SBIN/CRON[10151]: (root) CMD (/usr/local/ispconfig/server/server.sh > /dev/null 2>> /var/log/ispconfig/cron.log)
Sep 21 11:13:01 loft7403 /USR/SBIN/CRON[10152]: (web2) CMD (/var/www/clients/client1/web2/cd /var/www/clients/client1/web2/web/qweiugbzsq86ts2po/sugar2; php -f cron.php > /dev/null 2>&1)
Sep 21 11:13:01 loft7403 /USR/SBIN/CRON[10148]: (CRON) error (grandchild #10152 failed with exit status 1)
Sep 21 11:14:01 loft7403 /USR/SBIN/CRON[10164]: (root) CMD (/usr/local/ispconfig/server/server.sh > /dev/null 2>> /var/log/ispconfig/cron.log)
Sep 21 11:14:01 loft7403 /USR/SBIN/CRON[10165]: (web2) CMD (/var/www/clients/client1/web2/cd /var/www/clients/client1/web2/web/qweiugbzsq86ts2po/sugar2; php -f cron.php > /dev/null 2>&1)
Sep 21 11:14:01 loft7403 /USR/SBIN/CRON[10161]: (CRON) error (grandchild #10165 failed with exit status 1)
Sep 21 11:15:01 loft7403 /USR/SBIN/CRON[10178]: (web2) CMD (/var/www/clients/client1/web2/cd /var/www/clients/client1/web2/web/qweiugbzsq86ts2po/sugar2; php -f cron.php > /dev/null 2>&1)

also on a side note how do you setup ispconfig to run a cron every 5 minutes?
Thank you

[Ben]

is this a legitimate cron job? Maybe you might inspect it? At least from my perspective it looks a bit strange. So maybe sb broke in your server, so you should check what kind of applications / script are running for web2.

You might also check rkhunter (rootkit.nl).

Regarding running a cronjob every five minutes, set the minute portion to */5 everything else to *
e.g. */5 * * * * <command>

you should also consider using logwatch, as it would email you such kind of stuff on a daily basis.

[morraine]

Hi its not a hacker that put that there. i had put that originally. I've got sugarcrm on my server i put it in a folder that was not at the top of my site and was hard for people who don't know its location to just get to.

i now realise that you don't setup crons like that in ispconfig so i deleted it from inside the control panel in ispconfig but i'm still getting this in the logs after i deleted it.

How can this be?