How to find Onwer of Crontab entry

vr_mari · May 7, 2009, 12:12am

Hi,

How to find the onwer who added the of crontab entry?

Thnaks
Marov

incredible · May 7, 2009, 6:03am

root's crontab entry?
If yes, you should know who has root access to do so.

To investigate further, you must know when the cron file was modified by checking the /var/spool/cron/crontabs/root date/timestamp. Then check the history of the users or any auditing tool that you use

vr_mari · May 10, 2009, 1:41am

Thanks for your valuable information

gowthamakanthan · May 11, 2009, 7:09am

you cannot tell who added that crontab entry unless they put a comment on it:)

incredible · May 11, 2009, 7:19am

Definitely you can know who editted the file last, at least.

vr_mari · May 12, 2009, 5:57am

Hi incredible,

Can you tell me the procedure to find out who modified file and which entry he modified

Thanks
MaroV

incredible · May 12, 2009, 6:13am

I already mentioned before that you can check who modified the file last. Not which entry. its the same like any other OS files