Timeline for Detecting cron tasks run by another user
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 30, 2019 at 18:51 | comment | added | Stéphane Chazelas | inotify won't work on those files, but a busy loop starting one second before each minute that watches the contents of /sys/fs/cgroup/systemd/system.slice/cron.service/cgroup.procs and retrieves the corresponding command line from /proc/pid/cmdline should be able to capture the commands, especially if you slow down everything by allocating a lot of RAM to evict most things from the cache. | |
| Dec 20, 2016 at 15:27 | comment | added | Bigon | Indeed, but you could mix that with the idea from @piroux and add a inotify watch on the files in /sys/fs/cgroup/systemd/system.slice/cron.service/ | |
| Dec 20, 2016 at 14:39 | comment | added | Cybergibbons | Why does this not suffer from the same issue as the suggestion in the question i.e. short lived processes will be missed. | |
| Dec 11, 2016 at 12:08 | history | edited | magor | CC BY-SA 3.0 | improved formatting |
| Dec 11, 2016 at 11:51 | review | Late answers | |||
| Dec 11, 2016 at 12:08 | |||||
| Dec 11, 2016 at 11:35 | history | answered | Bigon | CC BY-SA 3.0 |