Cron log monitoring in Linux CLI - Step-by-Step Execution

Concept Flow - Cron log monitoring

Cron job runs

↓

Cron daemon logs event

↓

Log file updated (/var/log/cron or /var/log/syslog)

↓

User checks logs with commands

↓

User analyzes output for job status

Cron jobs run and the cron daemon writes events to log files. Users then check these logs to monitor job execution.

Execution Sample

Linux CLI

sudo tail -n 5 /var/log/cron
sudo grep CRON /var/log/syslog
journalctl -u cron.service --since "1 hour ago"

These commands show recent cron job logs from different log files and system journal.

Execution Table

Step	Command Run	Action	Output Example	Notes
1	sudo tail -n 5 /var/log/cron	Show last 5 lines of cron log file	May show lines like: "Apr 27 10:00:01 hostname CRON[1234]: (root) CMD (backup.sh)"	Reads cron log file directly
2	sudo grep CRON /var/log/syslog	Search syslog for cron entries	Lines containing 'CRON' with timestamps and commands	Syslog may contain cron logs depending on system config
3	journalctl -u cron.service --since "1 hour ago"	Show cron service logs from systemd journal	Entries with timestamps and cron job details	Works on systems using systemd
4	Analyze output	Look for job success or failure messages	No output means no recent cron jobs or no errors	User interprets logs to monitor cron jobs
5	Exit	User finishes monitoring	N/A	Monitoring session ends

💡 User stops after reviewing recent cron logs to check job status

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
cron_log_content	empty	last 5 lines of /var/log/cron	filtered lines with 'CRON' from /var/log/syslog	cron service logs from journalctl	final combined view for analysis

Key Moments - 3 Insights

Why do some systems use /var/log/cron while others use /var/log/syslog for cron logs?

Some Linux systems log cron events directly to /var/log/cron, while others include cron logs inside /var/log/syslog. This depends on system logging configuration, as shown in execution_table rows 1 and 2.

What does it mean if the cron log commands return no output?

No output means either no cron jobs ran recently or logs are stored elsewhere. Check execution_table row 4 where analyzing output shows no entries.

How does journalctl help in cron log monitoring?

journalctl queries systemd's journal for cron service logs, useful on modern systems using systemd, as shown in execution_table row 3.

Visual Quiz - 3 Questions

Look at the execution_table row 1, what does the command 'sudo tail -n 5 /var/log/cron' do?

A Displays cron service logs from the last hour

B Shows the last 5 lines of the cron log file

C Searches for the word CRON in syslog

D Starts a new cron job

💡 Hint

Refer to execution_table row 1 under 'Action' and 'Output Example'

At which step does the user check cron logs using systemd journal?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

See execution_table row 3 for journalctl command usage

If the system does not use systemd, which command from the execution_table is most likely to work?

A sudo systemctl status cron.service

B sudo grep CRON /var/log/syslog

C sudo tail -n 5 /var/log/cron

D journalctl -u cron.service --since "1 hour ago"

💡 Hint

Check execution_table rows 1 and 3 for systemd vs non-systemd commands

Concept Snapshot

Cron log monitoring:
- Cron jobs write logs to /var/log/cron or /var/log/syslog
- Use 'tail' to view recent logs
- Use 'grep' to filter cron entries in syslog
- Use 'journalctl' on systemd systems
- Analyze logs to check job success or failure

Full Transcript

Cron log monitoring involves checking the logs where cron jobs write their execution details. When a cron job runs, the cron daemon records the event in log files such as /var/log/cron or /var/log/syslog depending on the system. Users can run commands like 'sudo tail -n 5 /var/log/cron' to see the last few cron log entries, or 'sudo grep CRON /var/log/syslog' to filter cron-related lines in the system log. On systems using systemd, 'journalctl -u cron.service --since "1 hour ago"' shows recent cron service logs. By reviewing these logs, users can monitor if cron jobs ran successfully or if there were errors. If no output appears, it may mean no recent cron jobs ran or logs are stored differently. This step-by-step approach helps users visually track cron job activity through log files.

Practice

1. What is the main purpose of monitoring cron logs on a Linux system?

easy

A. To install new cron jobs automatically

B. To check if scheduled tasks ran successfully

C. To delete old cron jobs from the system

D. To speed up the execution of cron jobs

Solution

1. Step 1: Understand cron job scheduling

   Cron jobs are scheduled tasks that run automatically at set times.

2. Step 2: Purpose of cron log monitoring

   Monitoring cron logs helps verify if these tasks ran as planned and if there were any errors.

3. Final Answer:

   To check if scheduled tasks ran successfully -> Option B

4. Quick Check:

   Cron logs track task success = A [OK]

Hint: Cron logs show task run status, not installation or deletion [OK]

Common Mistakes:

• Confusing cron log monitoring with job installation
• Thinking cron logs speed up tasks
• Assuming cron logs delete jobs automatically

2. Which command correctly shows the last 10 lines of the cron log file located at /var/log/cron?

easy

A. tail /var/log/cron

B. head /var/log/cron

C. cat /var/log/cron | grep last 10

D. grep last /var/log/cron

Solution

1. Step 1: Understand the tail command

   The tail command shows the last lines of a file, defaulting to 10 lines.

2. Step 2: Apply tail to cron log

   Using tail /var/log/cron displays the last 10 lines of the cron log file.

3. Final Answer:

   tail /var/log/cron -> Option A

4. Quick Check:

   Last 10 lines = tail [OK]

Hint: Use tail to see recent log entries quickly [OK]

Common Mistakes:

• Using head shows first lines, not last
• Incorrect grep syntax for line count
• Confusing grep with tail for last lines

3. What will be the output of this command if the cron log contains these lines:

Jun 10 10:00:01 server CRON[1234]: (root) CMD (backup.sh)
Jun 10 10:05:01 server CRON[1235]: (root) CMD (cleanup.sh)
Jun 10 10:10:01 server CRON[1236]: (root) CMD (backup.sh)

Command: grep backup.sh /var/log/cron

medium

A. Jun 10 10:00:01 server CRON[1234]: (root) CMD (backup.sh)
Jun 10 10:10:01 server CRON[1236]: (root) CMD (backup.sh)

B. Jun 10 10:05:01 server CRON[1235]: (root) CMD (cleanup.sh)

C. No output

D. Jun 10 10:00:01 server CRON[1234]: (root) CMD (backup.sh)

Solution

1. Step 1: Understand grep filtering

   The grep backup.sh command filters lines containing 'backup.sh'.

2. Step 2: Identify matching lines in the log

   Two lines contain 'backup.sh': the first and third lines.

3. Final Answer:

   Both lines with backup.sh are shown -> Option A

4. Quick Check:

   grep filters matching lines = C [OK]

Hint: grep shows all lines containing the search term [OK]

Common Mistakes:

• Selecting only one matching line
• Expecting output for unrelated terms
• Thinking grep outputs no lines if multiple matches exist

4. You run grep CRON /var/log/cron | tail -5 but get no output, even though you know cron jobs ran recently. What is the most likely reason?

medium

A. Cron jobs do not write to /var/log/cron

B. The grep command syntax is incorrect

C. The tail command does not work with pipes

D. The cron log file is empty or missing

Solution

1. Step 1: Check command correctness

   The command syntax is correct; grep filters lines with 'CRON', tail shows last 5 lines.

2. Step 2: Consider log file state

   If no output appears, the log file may be empty or missing, so no lines match.

3. Final Answer:

   The cron log file is empty or missing -> Option D

4. Quick Check:

   No output usually means empty or missing file [OK]

Hint: No output often means empty or missing log file [OK]

Common Mistakes:

• Blaming grep syntax when it is correct
• Assuming tail can't work with pipes
• Thinking cron never logs to /var/log/cron

5. You want to monitor cron logs in real-time to see new entries as they appear. Which command should you use?

hard

A. grep -r CRON /var/log/cron

B. cat /var/log/cron | head -n 10

C. tail -f /var/log/cron

D. less /var/log/cron

Solution

1. Step 1: Understand real-time log monitoring

   Real-time monitoring means seeing new log lines as they are added.

2. Step 2: Use tail with follow option

   tail -f keeps the file open and shows new lines live.

3. Final Answer:

   tail -f /var/log/cron -> Option C

4. Quick Check:

   tail -f shows live log updates [OK]

Hint: Use tail -f to watch logs live as they update [OK]

Common Mistakes:

• Using grep -r which searches recursively, not live
• Using head only shows start, not live updates
• Using less does not auto-refresh new lines