Log of cron actions on OS X

Question

Does the cron which comes with OS X log its actions anywhere?

I'm not looking for output of any particular cron job, but rather log of what cron is doing. On a couple linux machines I've checked, there's /var/log/cron which has contents like:

Apr 26 11:00:01 localhost crond[27755]: (root) CMD (/root/bin/mysql-backup)
Apr 26 11:01:01 localhost crond[27892]: (root) CMD (run-parts /etc/cron.hourly)
Apr 26 11:07:01 localhost crond[28138]: (root) CMD (/usr/local/bin/python /home/
user1/scripts/pythonscript.py)
Apr 26 11:18:18 localhost crontab[28921]: (user2) LIST (user2)
Apr 26 11:18:22 localhost crontab[28929]: (user2) BEGIN EDIT (user2)
Apr 26 11:18:59 localhost crontab[28929]: (user2) REPLACE (user2)

This shows when jobs ran, when users viewed or edited crontabs, etc. This stuff is nowhere that I've found on my Snow Leopard machine.

score 52 · Accepted Answer · answered May 15 '13 at 12:10

52

Much easier to simply add the following to /etc/syslog.conf :

cron.*      /var/log/cron.log

Then restart syslog

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

Tested and working on OSX 10.7.4

answered May 15 '13 at 12:10

phil

544

Wow, much simpler. Have an upvote. I wonder if this would've worked on Snow Leopard. – Doug Harris May 15 '13 at 13:50
2

Works on Mavericks – Clustermagnet May 08 '14 at 14:43
1

Works on Yosemite – nickcoxdotme Jul 22 '15 at 18:34
Works on Snow Leopard, 10.6.8 (yes, I'm an antique...) – Daniel Griscom Jul 10 '16 at 02:29
Works on El Capitan – rottweiler Apr 28 '17 at 21:08
5

/System/Library/LaunchDaemons/com.apple.syslogd.plist: Operation not permitted while System Integrity Protection is engaged (10.13.2 High Sierra).
Do I have to disable SIP? Thanks! – Shane Lu Jan 04 '18 at 05:23

score 13 · Answer 2 · answered Apr 27 '10 at 18:27

I figured it how to log my cron job activity without switching each one over to launchd jobs.

The cron man page mentions -x options which enables "writing of debugging information to standard output." A side effect of this is that these also write basic information to standard error. Data sent to standard error is written to /var/log/system.log.

This results in data like this being written to /var/log/system.log:

debug flags enabled: misc
[42073] cron started
log_it: (user1 42084) CMD (/root/bin/mysql-backup)
log_it: (user1 42094) CMD (run-parts /etc/cron.hourly)

Since cron itself is launched by launchd, to enable this, I had to edit /System/Library/LaunchDaemons/com.vix.cron.plist so that it now looks like:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
    "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.vix.cron</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/sbin/cron</string>
        <string>-x</string>
        <string>misc</string>
    </array>
    <key>KeepAlive</key>
    <dict>
        <key>PathState</key>
        <dict>
            <key>/etc/crontab</key>
            <true/>
        </dict>
    </dict>
    <key>QueueDirectories</key>
    <array>
        <string>/usr/lib/cron/tabs</string>
    </array>
    <key>EnableTransactions</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/var/log/cron.log</string>
</dict>
</plist>

I used -x misc here, but it didn't seem to matter which options I used. Adding the -x started the logging of job activity. I also added the StandardErrorPath to write to /var/log/cron.log instead of the default /var/log/system.log.

And then unload and reload this:

$ sudo launchctl
Password:
launchd% unload /System/Library/LaunchDaemons/com.vix.cron.plist 
launchd% load /System/Library/LaunchDaemons/com.vix.cron.plist

score 1 · Answer 3 · answered Apr 26 '10 at 18:41

1

OSX now tends to use launchd rather than cron - Apple dev doc - so it might be there is nothing in cron to log.

Use launchctl to control the logging level of launchd. Som log info appears in system.log but more in the console app -> All messages

answered Apr 26 '10 at 18:41

mmmmmm

6,093

7

Hmmm, switching to launchd is something I could consider, but I'm a grumpy old unix user. I followed that link. The example on that page is 1046 bytes long to replace 24 characters of crontab 0 0 7 11 0 happybirthday. – Doug Harris Apr 26 '10 at 18:49

score 0 · Answer 4 · answered Apr 20 '15 at 20:37

0

At least on Yosemite, cron logs output as mail messages, so use the mail to read them.

answered Apr 20 '15 at 20:37

mcandre

3,036

cron sends (otherwise un-redirected) output to the owner of the job via mail. If all output is redirected, no mail is sent. (Even if a message is sent, I'm not sure whether it shows the command that was executed.) The question is asking how the administrator can see all the commands that cron has performed. To use your answer, a person would have to look at everybody's mail file. – G-Man Says 'Reinstate Monica' Apr 20 '15 at 22:46

Log of cron actions on OS X

4 Answers4

Linked

Related