How to find and read crontab logs
Cron jobs run in the background without user oversight and the log messages they leave behind can be essential to debugging and auditing. Learn how to find and make sense of them with this short guide.
Where are cron logs stored?
Cron logs are written to /var/log/syslog on Ubuntu and Debian, and /var/log/cron on RedHat and CentOS.
Show recent cron events in your syslog (Ubuntu and Debian):
grep CRON /var/log/syslog | tail -10
Show recent cron events in the cron log (RedHat and CentOS)
tail -10 /var/log/cron
You will likely require root/sudo privileges to access these logs.
On a host that uses systemd, the same events are in the journal. The unit is cron on Debian and Ubuntu, and crond on Red Hat and Fedora:
journalctl -u cron --since today
journalctl -u crond --since today
If /var/log/syslog is missing because rsyslog is not installed, journalctl -u cron is the log.
On macOS, cron writes to the unified log:
log show --predicate 'process == "cron"' --last 1h
What you'll find in the logs
Logs are written by the cron daemon when it starts-up, when it executes each job, and when it has an error reading a crontab file or running a requested command. Cron logs will not contain any of your cron job output or even their exit statuses.
If you are a Cronitor user, complete job output and exit code is captured for every execution and is available on your dashboard in the "Latest Activity" section of each job. Job monitoring is where that is configured. If you are not using Cronitor, write the output to a file by following this guide.
Want alerts if your cron jobs stop working?
As valuable as cron logs are, they can't tell you which cron jobs didn't run. Monitor your cron jobs with Cronitor to easily collect output, capture errors and alert you when something goes wrong.
How to read your cron logs
Cron logs store the hostname of the machine, the time the job was started, the user account, and the command run. In this example, a cron job ran on March 29th, on the data-processing host as the dataproc user. The command executed was /home/data-pipeline.py
Mar 29 16:15:01 data-processing CRON[12624]: (dataproc) CMD (/home/data-pipeline.py)