Log of cron actions on OS X

46

19

Does the cron which comes with OS X log its actions anywhere?

I'm not looking for output of any particular cron job, but rather log of what cron is doing. On a couple linux machines I've checked, there's /var/log/cron which has contents like:

Apr 26 11:00:01 localhost crond[27755]: (root) CMD (/root/bin/mysql-backup)
Apr 26 11:01:01 localhost crond[27892]: (root) CMD (run-parts /etc/cron.hourly)
Apr 26 11:07:01 localhost crond[28138]: (root) CMD (/usr/local/bin/python /home/
user1/scripts/pythonscript.py)
Apr 26 11:18:18 localhost crontab[28921]: (user2) LIST (user2)
Apr 26 11:18:22 localhost crontab[28929]: (user2) BEGIN EDIT (user2)
Apr 26 11:18:59 localhost crontab[28929]: (user2) REPLACE (user2)

This shows when jobs ran, when users viewed or edited crontabs, etc. This stuff is nowhere that I've found on my Snow Leopard machine.

Doug Harris

Posted 2010-04-26T15:25:39.933

Reputation: 23 578

Answers

12

I figured it how to log my cron job activity without switching each one over to launchd jobs.

The cron man page mentions -x options which enables "writing of debugging information to standard output." A side effect of this is that these also write basic information to standard error. Data sent to standard error is written to /var/log/system.log.

This results in data like this being written to /var/log/system.log:

debug flags enabled: misc
[42073] cron started
log_it: (user1 42084) CMD (/root/bin/mysql-backup)
log_it: (user1 42094) CMD (run-parts /etc/cron.hourly)

Since cron itself is launched by launchd, to enable this, I had to edit /System/Library/LaunchDaemons/com.vix.cron.plist so that it now looks like:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
    "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.vix.cron</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/sbin/cron</string>
        <string>-x</string>
        <string>misc</string>
    </array>
    <key>KeepAlive</key>
    <dict>
        <key>PathState</key>
        <dict>
            <key>/etc/crontab</key>
            <true/>
        </dict>
    </dict>
    <key>QueueDirectories</key>
    <array>
        <string>/usr/lib/cron/tabs</string>
    </array>
    <key>EnableTransactions</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/var/log/cron.log</string>
</dict>
</plist>

I used -x misc here, but it didn't seem to matter which options I used. Adding the -x started the logging of job activity. I also added the StandardErrorPath to write to /var/log/cron.log instead of the default /var/log/system.log.

And then unload and reload this:

$ sudo launchctl
Password:
launchd% unload /System/Library/LaunchDaemons/com.vix.cron.plist 
launchd% load /System/Library/LaunchDaemons/com.vix.cron.plist 

Doug Harris

Posted 2010-04-26T15:25:39.933

Reputation: 23 578

51

Much easier to simply add the following to /etc/syslog.conf :

cron.*      /var/log/cron.log

Then restart syslog

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

Tested and working on OSX 10.7.4

phil

Posted 2010-04-26T15:25:39.933

Reputation: 519

1Works on Yosemite – nickcoxdotme – 2015-07-22T18:34:47.660

Works on Snow Leopard, 10.6.8 (yes, I'm an antique...) – Daniel Griscom – 2016-07-10T02:29:27.557

Works on El Capitan – rottweiler – 2017-04-28T21:08:41.827

2/System/Library/LaunchDaemons/com.apple.syslogd.plist: Operation not permitted while System Integrity Protection is engaged (10.13.2 High Sierra).
Do I have to disable SIP? Thanks!
– Shane Lu – 2018-01-04T05:23:20.177

Wow, much simpler. Have an upvote. I wonder if this would've worked on Snow Leopard. – Doug Harris – 2013-05-15T13:50:33.467

2Works on Mavericks – Clustermagnet – 2014-05-08T14:43:15.290

1

OSX now tends to use launchd rather than cron - Apple dev doc - so it might be there is nothing in cron to log.

Use launchctl to control the logging level of launchd. Som log info appears in system.log but more in the console app -> All messages

user151019

Posted 2010-04-26T15:25:39.933

Reputation: 5 312

5Hmmm, switching to launchd is something I could consider, but I'm a grumpy old unix user. I followed that link. The example on that page is 1046 bytes long to replace 24 characters of crontab 0 0 7 11 0 happybirthday. – Doug Harris – 2010-04-26T18:49:47.303

-1

At least on Yosemite, cron logs output as mail messages, so use the mail to read them.

mcandre

Posted 2010-04-26T15:25:39.933

Reputation: 2 696

cron sends (otherwise un-redirected) output to the owner of the job via mail.  If all output is redirected, no mail is sent.  (Even if a message is sent, I'm not sure whether it shows the command that was executed.)  The question is asking how the administrator can see all the commands that cron has performed.  To use your answer, a person would have to look at everybody's mail file. – G-Man Says 'Reinstate Monica' – 2015-04-20T22:46:09.143