0

When I run a cronjob, it's nice being able to follow its logs. If I want to see all logs from cron with journalctl, I can select the cron unit (journalctl -u cron). But when I have multiple cronjobs, it's not very helpful filtering only for the cron unit.

Is there some way to filter for a specific cronjob in journalctl, or even specify a certain unit that it should belong to?

  • 1
    Is using a systemd timer instead of cron an option? Then you can treat the timer's service like any other service – muru Apr 10 '18 at 8:04
  • That is an option, but I've never found them as convenient. Mostly because it's another structure to learn, but also because a cronjob is quite literally one line which is executed exactly as it reads (while systemd timers are one .service-file and one .timer file, or something like that). – lindhe Apr 10 '18 at 9:03
1

Since these are simply messages from cron, the metadata is all about cron. Example for a couple of messages about a cronjob, using --output=json:

{
  "__CURSOR": "s=74429436aba942b6bbfc70cf45bfecc6;i=188d;b=108f80cdd87342bcb9dcafca15c45b57;m=6c13fcb19;t=5697ae32bb8a9;x=d292b55b7b7a140d",
  "__REALTIME_TIMESTAMP": "1523351401773225",
  "__MONOTONIC_TIMESTAMP": "29011987225",
  "_BOOT_ID": "108f80cdd87342bcb9dcafca15c45b57",
  "PRIORITY": "6",
  "_UID": "0",
  "_GID": "0",
  "_CAP_EFFECTIVE": "3fffffffff",
  "_MACHINE_ID": "5a75b95396344578a23193fb7b823946",
  "_HOSTNAME": "muru-1604",
  "_SYSTEMD_SLICE": "system.slice",
  "_TRANSPORT": "syslog",
  "SYSLOG_FACILITY": "10",
  "SYSLOG_IDENTIFIER": "CRON",
  "MESSAGE": "pam_unix(cron:session): session opened for user root by (uid=0)",
  "_COMM": "cron",
  "_EXE": "/usr/sbin/cron",
  "_CMDLINE": "/usr/sbin/CRON -f",
  "_AUDIT_LOGINUID": "0",
  "_SYSTEMD_CGROUP": "/system.slice/cron.service",
  "_SYSTEMD_UNIT": "cron.service",
  "SYSLOG_PID": "22158",
  "_PID": "22158",
  "_AUDIT_SESSION": "110",
  "_SOURCE_REALTIME_TIMESTAMP": "1523351401772733"
}
{
  "__CURSOR": "s=74429436aba942b6bbfc70cf45bfecc6;i=188e;b=108f80cdd87342bcb9dcafca15c45b57;m=6c13fcba9;t=5697ae32bb939;x=33e51a528b0cef96",
  "__REALTIME_TIMESTAMP": "1523351401773369",
  "__MONOTONIC_TIMESTAMP": "29011987369",
  "_BOOT_ID": "108f80cdd87342bcb9dcafca15c45b57",
  "PRIORITY": "6",
  "_UID": "0",
  "_GID": "0",
  "_CAP_EFFECTIVE": "3fffffffff",
  "_MACHINE_ID": "5a75b95396344578a23193fb7b823946",
  "_HOSTNAME": "muru-1604",
  "_SYSTEMD_SLICE": "system.slice",
  "_TRANSPORT": "syslog",
  "SYSLOG_IDENTIFIER": "CRON",
  "_COMM": "cron",
  "_EXE": "/usr/sbin/cron",
  "_CMDLINE": "/usr/sbin/CRON -f",
  "_AUDIT_LOGINUID": "0",
  "_SYSTEMD_CGROUP": "/system.slice/cron.service",
  "_SYSTEMD_UNIT": "cron.service",
  "SYSLOG_FACILITY": "9",
  "MESSAGE": "(root) CMD ([ -x /usr/sbin/dma ] && /usr/sbin/dma -q1)",
  "_AUDIT_SESSION": "110",
  "SYSLOG_PID": "22159",
  "_PID": "22159",
  "_SOURCE_REALTIME_TIMESTAMP": "1523351401773201"
}

These two are related (see for example, the PIDs or the timestamps), but that relation is not easily expressed as a filter.

As such, there's not much that journalctl do for you.


If you use a systemd timer, then the corresponding unit can of course be used as filter for journalctl (along with all the other benefits of systemd timers: check for next runtime, run a job immediately, properly stopping a long-running cronjob, etc.).

  • Too bad to hear, but it answers my question. – lindhe Apr 10 '18 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.