There are two vps: one is digitalocean, the other is bangwagong host.
All the operating systems on them are Debian7.
I want to split cron logfile up from syslog with the following steps.

vim /etc/rsyslog.conf
uncomment  the line # cron.*  -/var/log/cron.log  into
cron.*   -/var/log/cron.log
shutdown -r now  
/etc/init.d/cron restart

Now in the digitalocean vps, there is a cron.log in /var/log. But in the bangwagong vps, there is no cron.log in /var/log. Who can explain it?

The steps are tested on my local machine; the cron.log was split up successfully.


The docs I was reading were incorrect, so the bit about file syncing is completely wrong.

The '-' removes logging from a file, so here's what I added to my system to log cron entries into /var/log/cron.log + disable /var/log/syslog duplicate logging.

... .;cron,auth,authpriv.none -/var/log/syslog cron.* /var/log/cron.log ...

So add 'cron' to the -/var/log/syslog entry to disable syslog logging.

Uncomment 2nd line to startup cron.log logging.

Then go through the tail + rsyslog restart sequence + you should see the exact reason why cron isn't logging correctly.


There is no requirement to reboot (shutdown -r now).

Try this. From one window run:

tail -f /var/log/syslog

From another, run:

service rsyslog restart

1) make sure rsyslog stops + restarts with no errors.
2) the tail of syslog will likely tell you what's required to fix.

Keep in mind, your logging may be working.

The '-' in front of log file disables sync after every line written, so if your machine is busy or the sync delay in your system is long, then several seconds may be required for log entries to show up.

You might first remove the '-' in front of /var/log/cron.log (so entries are flushed/synced to disk quickly) + ensure all's working well + then put the '-' back.

  • No,it don't work for me.
    – showkey
    Jul 11 '15 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.