Re: [FW-1] Running Cron job on Secure Platform AI

[RHislop@FW1-NOSPAMBURNTSAND.COM]

Thanks to everyone who sent their assistance. In the end, I just added the
CP.sh script to the top of my script (as was one of the suggestions) and
everything is working great.

Thanks again.

Rick

-----Original Message-----
From: Sid Van den Heede [mailto:sidv@opentext.com]
Sent: Thursday, October 02, 2003 9:58 AM
To: Mailing list for discussion of Firewall-1; Rick Hislop
Subject: Re: [FW-1] Running Cron job on Secure Platform AI


On Thu, 2003-10-02 at 11:56, RHislop@BURNTSAND.COM wrote:
> Hi all,
> I have an issue trying to run a backup script on NG w/ AI Secure
> Platform. When the script is run manually (from the shell) and it runs
> fine. When it is run via cron, it fails. From what I can tell, the
> environment variables are not active in the context of cron and when the
> script tries to run backup_start (backup command) it doesn't know where
> anything is. I've attached the script as well as some errors in various
> logs. Your help is greatly appreciated
...
> ** From /var/log/messages log **
> Sep 30 23:59:00 ptcfw1 CROND[21462]: (root) CMD
> (/etc/init.d/cp_backup.sh)
> Sep 30 23:59:00 ptcfw1 CronDaemon: Cron <root@ptcfw1>
> /etc/init.d/cp_backup.sh (Environm
> ent: <SHELL=/bin/sh>, <HOME=/root>, <PATH=/usr/bin:/bin>,
> <LOGNAME=root>) : /etc/init.d/
> cp_backup.sh: cpstop: command not found

Your PATH doesn't include the Check Point directories, just /usr/bin and
/bin.

> ** Backup Script **
>
> #! /bin/bash
> CPDATE=`date +%m%d%y-%H%M`
> LOGSERVER="IP of log server"
> CPLOG=/var/cplog/CPBACKUP.LOG
> CPTEMP=/tmp/cptemp.log
>
> # Stop firewall services
> cpstop

Any script that is to be run by a user with elevated privileges should set
PATH explicitly.  You could do that, hard coding the directories that
contain the appropriate Check Point commands, but that changes from one FP
to the next.

I'm going to assume Linux here.  The details will be slightly different
under
Solaris or other OS.  When CP was installed, it created a file called
/etc/profile.d/CP.sh.  When you login, that script is run along with many
others.  CP.sh updates your PATH and sets other environment variables.

You could just run that script at the start of your script, like so:

. /etc/profile.d/CP.sh

The initial dot is an essential part of the command line (indeed, it is the
command).  Without it, the script will run in a subshell, which will exit
before your script continues.  The net effect on your script's environment
would be nil.

BTW, you should put your script into something like /usr/local/bin or
/usr/local/sbin, not /etc/init.d.  That is for init scripts.

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================