Where Are Cron Logs Stored?

Quick Answer

Cron Log Locations by OS

Ubuntu & Debian

On Ubuntu and Debian, cron writes to the system log via syslog. Filter for cron entries with:

grep CRON /var/log/syslog

To watch cron events in real time:

tail -f /var/log/syslog | grep CRON

On systemd-based systems, you can also use journalctl:

journalctl -u cron

CentOS, RHEL & Fedora

Red Hat-based distributions log cron activity to a dedicated file:

cat /var/log/cron

For live monitoring:

tail -f /var/log/cron

Note that the cron daemon is named crond on these systems. For journald:

journalctl -u crond

Arch Linux

Arch uses cronie by default and logs exclusively through journald:

journalctl -u cronie

Alpine Linux

Alpine uses crond from BusyBox and logs to:

cat /var/log/cron

If that file does not exist, check /var/log/messages instead.

macOS

macOS uses the unified log system. Query cron entries with:

log show --predicate 'process == "cron"' --last 1h

On older macOS versions, cron logs may also appear in:

grep cron /var/log/system.log

How to Enable Cron Logging

On Ubuntu and Debian, cron logging to a dedicated file is disabled by default. To enable it:

1. Edit the rsyslog configuration:

sudo nano /etc/rsyslog.d/50-default.conf

2. Find and uncomment this line:

cron.*    /var/log/cron.log

3. Restart rsyslog:

sudo systemctl restart rsyslog

Cron entries will now be written to /var/log/cron.log in addition to syslog.

On CentOS/RHEL, cron logging is enabled by default. If it is missing, verify that rsyslog is running and that /etc/rsyslog.conf contains the cron.* rule.

Understanding Cron Log Entries

A typical cron log entry looks like this:

Mar 24 03:15:01 server CRON[12345]: (root) CMD (/usr/local/bin/backup.sh)

Each field tells you something specific:

Important: cron logs only record that a job ran. They do not capture the job's stdout or stderr output. To capture command output, you need to redirect it yourself (see next section).

Redirecting Cron Job Output

To capture a cron job's stdout and stderr to a file, append a redirect to your crontab entry:

0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

Breaking that down:

• >> appends stdout to the file (use > to overwrite)
• 2>&1 redirects stderr to the same file as stdout

To capture stdout and stderr to separate files:

0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>> /var/log/backup-error.log

To discard all output (silent mode):

0 3 * * * /usr/local/bin/backup.sh > /dev/null 2>&1

You can also use MAILTO in your crontab to receive output via email:

MAILTO=admin@example.com
0 3 * * * /usr/local/bin/backup.sh

If the job produces any stdout or stderr, cron sends it to the specified email address. Set MAILTO="" to disable email notifications entirely.

Checking Cron Logs with journald

On systems using systemd (most modern Linux distributions), you can query cron logs through journalctl regardless of syslog configuration:

# View all cron logs (Ubuntu/Debian)
journalctl -u cron

# View all cron logs (CentOS/RHEL)
journalctl -u crond

# Filter by time range
journalctl -u cron --since "1 hour ago"

# Show only today's entries
journalctl -u cron --since today

# Follow in real time
journalctl -u cron -f

# Filter by specific user
journalctl -u cron | grep "(www-data)"

The journalctl approach works even when traditional log files have been rotated or deleted. It is the most reliable way to access cron logs on modern Linux systems.

Common Cron Log Issues

Cron logs are empty or missing

Check that the cron daemon is running:

# Ubuntu/Debian
systemctl status cron

# CentOS/RHEL
systemctl status crond

If cron is running but logs are empty, cron logging may be disabled in your syslog configuration. See the enable logging section above.

Permission denied reading log files

Log files under /var/log/ are typically owned by root or the syslog user. Use sudo to read them:

sudo grep CRON /var/log/syslog

Old logs are gone (log rotation)

Most systems rotate logs automatically via logrotate. Older entries move to compressed files like syslog.1, syslog.2.gz, etc. To search rotated logs:

zgrep CRON /var/log/syslog.*.gz

Job ran but produced no output

If you see the job in cron logs but your output file is empty, the issue is in your script, not cron. Common causes include wrong PATH, missing environment variables, or permission errors. Test your script manually with the same user cron uses:

sudo -u www-data /usr/local/bin/backup.sh

Skip the Log Hunting

With CronJobPro, every job execution is automatically logged with response status, timing, headers, and body content. No SSH access needed, no grep commands, no wondering which file to look in.

Your execution log shows exactly what happened: when the job ran, how long it took, the HTTP response code, and the full response body. Failed jobs trigger instant alerts via email or webhook.

Website monitoring, API health checks, and scheduled tasks all get the same centralized logging dashboard without you configuring anything on your server.

FAQ