Cron job keeps running, not in any crontabs

Question

Some time ago I set up a cron job that would run a shell script to update my dynamic DNS. I've since done the proper Mac thing and switched over to launchd to handle that job and any other scheduled tasks I might have. As part of this process, I removed all cron jobs from my user's crontab (the only user on the machine) and also checked to make sure root's crontab was empty (it is).

However, the cron job keeps running. I know this, because I'm always greeted with "You have mail." when I open a terminal window, which then has tons and tons of messages from cron announcing that it couldn't complete it's job.

Here's a sample of the mail subjects:

Last login: Tue Mar 25 12:19:31 on ttys002
You have mail.
imac:~ dongohuber$ mail
Mail version 8.1 6/6/93.  Type ? for help.
"/var/mail/dongohuber": 1475 messages 1475 unread
>U  1 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  2 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  3 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  4 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  5 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  6 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  7 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  8 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U  9 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"
 U 10 MAILER-DAEMON@server  Mon Mar 17 18:57  77/2870  "Undelivered Mail Returned to Sender"

Update: The mail messages appear in large groups like this periodically. I'm afraid I'm not sure exactly how often (I just deleted the last giant batch of them -- I'll update this when the next one comes in), but they're definitely not appearing at the rate the cron job was set for, which was once every 5 minutes. Of course, this could be a function of the mailer daemon and not the phantom cron job, so I don't know if that matters.

And the messages themselves look like this:

    Message 1:
From MAILER-DAEMON  Mon Mar 17 18:57:27 2014
X-Original-To: [email protected]
Delivered-To: [email protected]
Date: Mon, 17 Mar 2014 18:57:21 -0400 (EDT)
From: [email protected] (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [email protected]
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
        boundary="0A1C11B3DE54.1395097041/server.homenetwork.private"

This is a MIME-encapsulated message.

--0A1C11B3DE54.1395097041/server.homenetwork.private
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

This is the mail system at host server.homenetwork.private.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<[email protected]> (expanded from <dongohuber>): delivery
    temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection
    refused

--0A1C11B3DE54.1395097041/server.homenetwork.private
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; server.homenetwork.private
X-Postfix-Queue-ID: 0A1C11B3DE54
X-Postfix-Sender: rfc822; [email protected]
Arrival-Date: Wed, 12 Mar 2014 03:10:00 -0400 (EDT)

Final-Recipient: rfc822; [email protected]
Original-Recipient: rfc822; dongohuber
Action: failed
Status: 4.4.1
Diagnostic-Code: X-Postfix; delivery temporarily suspended: connect to
    127.0.0.1[127.0.0.1]:10024: Connection refused

--0A1C11B3DE54.1395097041/server.homenetwork.private
Content-Description: Undelivered Message
Content-Type: message/rfc822

Return-Path: <[email protected]>
Received: by server.homenetwork.private (Postfix, from userid 501)
        id 0A1C11B3DE54; Wed, 12 Mar 2014 03:10:00 -0400 (EDT)
From: [email protected] (Cron Daemon)
To: [email protected]
Subject: Cron <dongohuber@server> /Users/dongohuber/duckdns/duck.sh > /dev/null
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=dongohuber>
X-Cron-Env: <USER=dongohuber>
X-Cron-Env: <HOME=/Users/dongohuber>
Message-Id: <[email protected]>
Date: Wed, 12 Mar 2014 03:10:00 -0400 (EDT)

/bin/sh: /Users/dongohuber/duckdns/duck.sh: No such file or directory

--0A1C11B3DE54.1395097041/server.homenetwork.private--

These constant mail alerts are driving me crazy. I have no idea where this cron job is coming from or how I can stop it. Here's what the computer reports for the crontabs for my user (which is also the one named in the mail, unless I'm totally misinterpreting it) and root:

imac:~ dongohuber$ crontab -l
crontab: no crontab for dongohuber
imac:~ dongohuber$ sudo crontab -l
crontab: no crontab for root
imac:~ dongohuber$

Where the heck is the cron job coming from and how can I get rid of it? If it matters, I'm running Mavericks.

Answer 1

You may want to check the following location, as this is where OS X stores crontabs:

/usr/lib/cron/tabs/

There may be a crontab which is stored there which is running your job. This is a directory that needs root privileges to access, so you may need to drop into a root shell using the sudo -s command before you'll be able to go into this directory.