Learn where cron writes its messages and how to extract the lines that tell you what ran and why. 16.11.2025 | reading time: 3 min Cron silently runs jobs; when they fail he needs concrete evidence: log lines. This short guide shows where cron messages appear and gives commands he can run now to see who ran what and when. Reproduce a failing job Run these commands to view recent cron activity and extract the command lines that cron executed: ```bash $ sudo journalctl -u cron.service --since 2025-11-14 --no-pager Nov 16 10:15:01 host CRON[12345]: (root) CMD (/usr/local/bin/backup.sh) Nov 16 10:17:01 host CRON[12346]: (alice) CMD (/home/alice/cleanup.sh) $ sudo grep CRON /var/log/syslog | tail -n 5 Nov 16 10:15:01 host CRON[12345]: (root) CMD (/usr/local/bin/backup.sh) ``` The first block shows journalctl output for the cron service; the second greps the traditional syslog file to find identical entries. Act on what you find If a job logged an error, he should inspect the exact command and its wrapper script, then rerun it interactively; check exit codes, environment differences and file permissions. Also examine the user crontab with `crontab -l -u username` and review `/etc/cron.d`, `/etc/cron.daily` and the script she calls to reproduce the failure. Log formats, rotation and filters Cron messages may land in `/var/log/cron`, `/var/log/syslog` or the systemd journal depending on the distribution and syslog configuration; logs may be rotated by `logrotate`, so search archived files as well. Use `journalctl -u cron.service --since 1h` or `journalctl SYSLOG_IDENTIFIER=CRON` to narrow time windows and identifiers when troubleshooting. Related helpers Daemon behavior and log delivery depend on `rsyslog` or `systemd-journald` and on cron implementations like `cronie` or `dcron`; if outputs vanish, check log permissions, imuxsock rules and SELinux audit messages to find denial traces. Final perspective Reading cron logs is investigative work: find the line that matches the failure time, follow the invoked command into its script and fix the root cause; repeat until the cron job behaves reliably. Keep digging into logging, scripting and process handling to master system automation and consider formal certification such as CompTIA Linux+ or LPIC-1 with focused preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. troubleshooting processes utilities scripting
