Scheduled task execution

The cron log file, located at /var/log/cron, is where the cron daemon logs its activities. It provides valuable information about all the cron jobs executed on the system.

Each entry in the cron log file is a line of text that includes several pieces of information. A typical entry may look something like this:

Jul  4 01:01:01 rhel-richmondfc run-parts[7909]: (/etc/cron.hourly) starting 0anacron
Jul  4 01:01:01 rhel-richmondfc anacron[7922]: Anacron started on 2023-07-04
Jul  4 01:01:01 rhel-richmondfc anacron[7922]: Normal exit (0 jobs run)
Jul  4 01:01:01 rhel-richmondfc run-parts[7909]: (/etc/cron.hourly) finished 0anacron
Jul  4 01:01:01 rhel-richmondfc CROND[7908]: (root) CMDEND (run-parts /etc/cron.hourly)
Jul  4 01:41:10 rhel-richmondfc atd[8497]: Starting job 2 (a0000201ad6515) for user 'tlasso' (1000)

This log line can be broken down into the following parts:

  • timestamp: The timestamp when the cron job was executed.
  • hostname: The hostname of the system where the cron job was run.
  • Cron Deamon[Process Id]: The name of the cron daemon (CROND, anacron, atd, run-parts etc) and the process ID (PID) of the cron job inside the square brackets.

The text parts after the : depends on the daemon.

The cron daemon has the following details.

  • (root): This signifies that the user who owns the cron job is root.

  • CMDEND (run-parts /etc/cron.hourly): The CMDEND part indicates that the execution of a specific command has ended. In this case, the command is run-parts /etc/cron.hourly, which is a standard way of running all scripts in the /etc/cron.hourly directory on an hourly basis.

The atd daemon has the following details.

  • Starting job 2 (a0000201ad6515): This indicates that a job was started. The number 2 is a local identification number for the job, and a0000201ad6515 is the unique identifier for the job.

  • for user 'tlasso' (1000): This indicates the username and user ID of the user who scheduled the job. In this case, the user is tlasso and the user ID is 1000.

The run-parts utility has the following details.

  • (/etc/cron.hourly): This is the directory whose scripts were run by run-parts. In this case, it's the /etc/cron.hourly directory, indicating these are tasks scheduled to run on an hourly basis.

  • starting 0anacron: This indicates the specific script that's being started. In this case, it's the 0anacron script. The "0" prefix is often used in script names to control the order in which they're run, since run-parts runs scripts in lexicographic order.