How to get alert when crontab changes?

Question

I've got about a dozen servers that each have crontabs with anywhere from 20-50 crontab entries. My single most common cause of a process failure is someone commenting out jobs in cron during a fix or patch and then forgetting to uncomment the jobs.

I'd like to do two things to solve this:

1. Start using our schedule suppression process that allows users to suppress schedules without actually touching crontab. Nothing magical - just touch a file in a directory dedicated to the process. The process checks that directory on start-up.
2. Implement a process that will send out alerts if crontab doesn't match its backup or current version in svn.

Can anyone recommend an existing solution for #2 (alert when crontab changes)?

Answer 1

In this case i would suggest to compare hashvalues of the file you want to have and the actual file.

Just write a little bashscript that sends out a emailnotification or creates a notification file or whatever you want and let this script be run automatically every x seconds / minutes / hours.

A possible script could be

if [[ $(md5sum path/to/crontab.backup | cut -d' ' -f1) == $(md5sum /etc/crontab | cut -d' ' -f1) ]]
then
    # send your notification
fi

This is a very simple solution to check if a file was changed since the last backup was made.