cron.log "expr: syntax error" entries.

Discussion in 'Installation/Configuration' started by Plutocrat, Apr 6, 2016.

  1. Plutocrat

    Plutocrat New Member

    This had been bugging me for some time, and I finally figured it out, so I thought I'd post the solution to this forum.
    A couple of months back I started getting these errors appearing in my /var/log/ispconfig/cron.log
    Mon Apr 4 23:00:45 UTC 2016 expr: syntax error
    They always started around 23:00:40, give or take five seconds. There were always 20 entries which lasted around a minute until 23:01:40 give or take ten seconds.
    My first instinct was to look through all the cron jobs on the system: those held in /etc/ and the individual user entries, and also anacron. Nothing started at 23:00. Hmmm. So it must be the line in crontab which runs every minute:
    * * * * * /usr/local/ispconfig/server/
    I looked through that script but didn't get any clues.
    Then I decided to lay a "trap". I'd write a script to go off at 23:00, and print the output of ps to a text file every ten seconds for the next two minutes. It looked a bit like this
    for COUNT in $(seq 14)
    /bin/ps aux | /bin/grep -v "\[" | /bin/grep -v php-fpm > /root/mystery/ps-$COUNT.txt
    sleep 10

    When I looked at the files the next day, it seemed that rkhunter might be the problem as it was active for around two minutes at that period. I ran it manually and got a load of errors. These were because I'd upgraded Debian 7 to Debian 8, and the database of known file signatures wasn't up to date, hence it was complaining. So running 'rkhunter --propupd' updated the database, and no more errors. Case closed.
    till likes this.

Share This Page