crontab using cru -not working

[chandras002]

Dear all,

last few days, struggling on this... i want to run tcpdump for every 1 hours using crontab on my Asus merlin - AC88U - firmware 380.65_4. Now testing for every 1 min

so,
1) I have a script name admin.sh : /jffs/scripts/admin.sh

!/bin/sh
        
echo This is test script running
tcpdump -w a1.pcap -i eth0 -s 65535

Make it executable and it works interactively from command line (creates .pcap file )
2) services-start on jffs/scripts - has following code

#!/bin/sh
sleep 20
/opt/etc/init.d/rc.unslung start

/usr/sbin/cru  a TCPdump2 "*/1 * * * * /jffs/scripts/sh admin.sh"

# enable the  following seems no effect
#cp /jffs/configs/cron /var/spool/cron/crontabs/admin

3) on Router, permission enable to run jffs scripts

What is happening? I can not see a1.pcap file on /jffs/scripts folder.
on System log, i can see the following

rond[538]: USER admin pid 1656 cmd /jffs/scripts/sh admin.sh
Apr  1 18:55:01 cron[1660]: (admin) CMD (/opt/bin/run-parts /opt/etc/cron.5mins^I)
Apr  1 18:55:01 cron[1661]: (admin) CMD (/opt/bin/run-parts /opt/etc/cron.1min^I

4) Output of cru l

admin@RT-AC88U-1D88:/jffs/scripts# cru l
*/1 * * * * /jffs/scripts/sh admin.sh #TCPdump2#
admin@RT-AC88U-1D88:/jffs/scripts#

why i can not see pcap file , if the script is running. ? please advise ..

>>cru a TCPdump2 "*/1 * * * * /jffs/scripts/sh admin.sh , used sh because i use admin.sh from command line (manually) the script giving ->>-sh: admin.sh: not found error.

 

[swetoast]

seems you got some spaces in your cru line

add that to services-start

cru a TCPdump2 "*/1 * * * * /jffs/scripts/admin.sh"

also make the script executable skip the whole sh stuff in the command else it would be

/bin/sh /path/to/command

so i suggest this instead make it executable

chmod +x /jffs/scripts/admin.sh

try that and see if it works better

 

[chandras002]

OK. Got the point.will try and update here..
Came across the following link... will it work ? I tried new firmware.. not succes

https://andidittrich.de/2017/01/how...-with-asuswrt-merlin.html#your_crontab_file_1
Any thoughts ...Welcome!

 

[Martineau]

1) I have a script name admin.sh : /jffs/scripts/admin.sh

!/bin/sh
      
echo This is test script running
tcpdump -w a1.pcap -i eth0 -s 65535

Most scripts usually have '#!/bin/sh' as the first line!

This test (non-script version) works for me

cru a TCPdump2  "*/1 * * * *" tcpdump -G 59 -W 1 -w /tmp/a1.pcap -i eth0 -s 65535

cru l
*/1 * * * * tcpdump -G 59 -W 1 -w /tmp/a1.pcap -i eth0 -s 65535 #TCPdump2#

 

[chandras002]

Most scripts usually have '#!/bin/sh' as the first line!

This test (non-script version) works for me

cru a TCPdump2  "*/1 * * * *" tcpdump -G 59 -W 1 -w /tmp/a1.pcap -i eth0 -s 65535

cru l
*/1 * * * * tcpdump -G 59 -W 1 -w /tmp/a1.pcap -i eth0 -s 65535 #TCPdump2#

1 ) It is typo - when typing on the forum . I have checked - the actual file #!/bin/sh
2) yes. non script version works for me too.. .. not bad.. after long struggle..Not sure..what is issue of script

 

[chandras002]

you seemed to have slipped an extra /sh into the path to your admin.sh script

Hi Tomsk, it corrected. it is not typo or mistake. i purposely add -sh because sh admin.sh - executed on command line otherwise, getting error.
Later understand, /bin/sh admin.sh - correct way.

 

[tomsk]

Hi Tomsk, it corrected. it is not typo or mistake. i purposely add -sh because sh admin.sh - executed on command line otherwise, getting error.
Later understand, /bin/sh admin.sh - correct way.

Yes i re-read your original post...... saw you mentioned the reason already.... my bad

 

[Martineau]

1 ) It is typo - when typing on the forum . I have checked - the actual file #!/bin/sh
2) yes. non script version works for me too.. .. not bad.. after long struggle..Not sure..what is issue of script

Does this script work ? either when executed manually from the command line or via cron?

#!/bin/sh

logger -st "($(basename $0))" "Running....."

HHMM=$(date +"%H%M")

tcpdump -G 59 -W 1 -w /opt/a${HHMM}.pcap -i eth0 -s 65535 2> /dev/null

 

[chandras002]

Dear Marin,

1) I copied the script to admin.sh - run from command line it work
2) Later in used cru in services-start
cru a TCPdump2 "*/1 * * * * /jffs/scripts/admin.sh"

seems it working . as time stamp based a2252.pacp created. And it's size rolling (changing) and reset every 1 min.
Later find another time stamp pcap file created after 10 minutes. The size is rolling and reset too. Guess, something to do with G flag.

Wonder, what is the problem earlier. Any way, Thanks for your time and efforts! (Thanks all other members too).
This community spirit makes ASUS- Merlin a special.

Cheers!
chandra

 

[Martineau]

.... Guess, something to do with G flag.

When tcpdump is started, by default (without any 'limiting' flags) it will continuously write to either sysout or the '-w file_name' until the process is physically terminated.

So if you are requesting tcpdump every minute via cru, then the '-G 59 -W 1' flags determines how many seconds the existing tcpdump process will run until it automatically terminates - in this case it will terminate 1 second before the next instance is requested unless you really want several tcpdump processes running concurrently?

You can tailor the flags to suit your needs for keeping several generations of the files.

 

[chandras002]

Dear Martin and fellow friends,

Seems still some problem. . I am seeing the new pcap file every 10 min, though the cron should be every min interval. After 10 min, new pcap file created and updated.. in the same time, i seeing the previous files also updating...

Please see the attached screenshot. The following should call the admin.sh - every min right. I tried */2 * * * * as well. View attachment 8953

Here is pcap file - which created for every 10 min like 10.44am, 10.54am ....till 11.54am. not sure why the C1144.pcap .

The pcap file take local time -is morning 10 am to 11am...like C1154.pcap.
Cron inside services-start. admin..sh in moved to USB.

So, te main questions - why the previous time -stamped file still updating (increasing the file size)..it should be stopped for every 1 min. Right? .. Any thoughts highly welcome. Thanks a lot.

 

[Martineau]

So, te main questions - why the previous time -stamped file still updating (increasing the file size)..it should be stopped for every 1 min. Right? .. Any thoughts highly welcome. Thanks a lot.

Try the modified tcpdump command

https://www.snbforums.com/threads/crontab-using-cru-not-working.38348/#post-316200

The manual (non-script) command that I suggested you try...which you did successfully in post #5

https://www.snbforums.com/threads/crontab-using-cru-not-working.38348/#post-316196

probably dropped the '-W 1' arg in the script?

 

[chandras002]

Here is script... do not see anything strange..following is the current tcpdump command (yes -W 1 dropped - not using -C anymore )
tcpdump -w /tmp/mnt/ex2/entware-ng.arm/C${HHMM}.pcap -i eth0 -s 65535 host 66.96.199.138
Am I missing?

yes, #5 post, worked.. technically correct. but the i am getting all the previous time stamped files too updating..either for 5 min or 1 hours... that is confusing.

 

[Martineau]

tcpdump -w /tmp/mnt/ex2/entware-ng.arm/C${HHMM}.pcap -i eth0 -s 65535 host 66.96.199.138.

FFS - RTFM!!!

Without the 'G xx -W 1' parms or 'C xxxx' etc. using your command syntax (above), an executing instance of tcpdump will continue to run until it either is manually terminated or will recycle a file based on size etc.

However, if you manually issue

tcpdump -G 59 -W 1 -w /opt/CAAAA.pcap -i eth0 -s 65535 &

then wait 10 seconds and issue

tcpdump -G 59 -W 1 -w /opt/CBBBB.pcap -i eth0 -s 65535 &

ps | grep tcpdump | grep -v "grep tcpdump" | wc -l

there should be 2 reported instances of tcpdump running...writing to

CAAAA.pcap and CBBBB.pcap

If you now wait a further 60 seconds, both instances will issue message:

Maximum file limit reached: 1

stating that they have automatically terminated (due to the ' -G 59 -W 1' parameters) and command

ps | grep tcpdump | grep -v "grep tcpdump" | wc -l

should report 0.

If the cru schedule is incorrect then it may contribute to the timestamp issues etc., but I suspect it is lack of reading the tcpdump man pages that is causing the real issue.

Good luck.

 

[chandras002]

Dear Martin, Thank for kindness... I take it in right spirit....
yes my friend too said "read the Man page". I go through the details and nitty-gritty & post it here. (for the other forum readers)

 

[Csection]

I am having a similar issue with this script:
#!/bin/sh

cru a malware-filter "0 */12 *** /jffs/scripts/malware-filter"

When I type cru l. it shows the job is loaded, but it does not run!
Could this be a cron issue or is it a script error?

 

[octopus]

Use:

cru a malware-filter "0 */12 * * * /jffs/scripts/malware-filter"

If you have .sh at end

cru a malware-filter "0 */12 * * * /jffs/scripts/malware-filter.sh"

@Csection

 

[Csection]

Use:

cru a malware-filter "0 */12 * * * /jffs/scripts/malware-filter"

Thank you for the quick reply!
I will try that.

 

[Csection]

Thank you for the quick reply!
I will try that.

What about this one :
#!/bin/sh
# Load ipset filter rules

sh /jffs/scripts/malware-filter

It is in my firewall-start script, but it doesn't run either.

 

[octopus]

If you use this, you have to have .sh then end of file.

#!/bin/sh
sh /jffs/scripts/malware-filter.sh