Cron log monitoring in Linux CLI - Commands & Configuration

Introduction

Cron is a tool that runs scheduled tasks on your computer. Monitoring its logs helps you check if these tasks ran successfully or if there were errors.

When you want to verify that a scheduled backup job ran at the right time.

When you need to find out why a script scheduled with cron did not work.

When you want to track how often a maintenance task executes on your server.

When you want to check if cron jobs are causing errors or warnings.

When you want to audit the history of automated tasks for troubleshooting.

Commands

This command searches the system log for all entries related to cron jobs to see their execution details.

Terminal

sudo grep CRON /var/log/syslog

Expected Output

Jun 10 10:00:01 my-server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 11:00:01 my-server CRON[5678]: (root) CMD (backup.sh)

→

-i - Makes the search case-insensitive (not used here but useful)

Shows the last 20 lines of the system log filtered for cron entries to quickly check recent cron activity.

Terminal

tail -n 20 /var/log/syslog | grep CRON

Expected Output

Jun 10 11:00:01 my-server CRON[5678]: (root) CMD (backup.sh)

Jun 10 12:00:01 my-server CRON[9101]: (root) CMD (cleanup.sh)

→

-n - Specifies the number of lines to show from the end of the file

Displays the entire cron-specific log file if your system keeps a separate cron log for easier monitoring.

Terminal

sudo cat /var/log/cron.log

Expected Output

Jun 10 10:00:01 my-server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 11:00:01 my-server CRON[5678]: (root) CMD (backup.sh)

Key Concept

If you remember nothing else from cron log monitoring, remember: checking the system log for 'CRON' entries shows when and what cron jobs ran.

Common Mistakes

Trying to check cron logs without sudo permissions

Most system logs require root access to read, so the command will fail or show no output.

Use sudo before commands like grep or cat to access cron logs.

Looking for cron logs in the wrong file

Different Linux systems store cron logs in different files; using the wrong file shows no results.

Check /var/log/syslog or /var/log/cron.log depending on your system.

Not filtering logs for 'CRON' keyword

System logs contain many entries; without filtering, it's hard to find cron job details.

Always use grep CRON to filter relevant cron job entries.

Summary

Use grep CRON on /var/log/syslog to find cron job execution entries.

Use tail with grep to quickly check recent cron activity.

Some systems have a dedicated /var/log/cron.log file for cron logs.

Use sudo to ensure you have permission to read system log files.