Cron jobs not executing — cron daemon down or misconfigured
Scheduled cron jobs are not running at the expected time
Focused incident mode — strips away everything but this runbook.
Symptoms
- Scheduled cron jobs are not running at the expected time
- No cron mail output even though the job should produce output
- System reboot and cron jobs did not resume
Evidence to grab
Collect these artifacts before you change anything — they prove (or rule out) each cause.
Cron service status
systemctl status cron 2>/dev/null || systemctl status crond 2>/dev/nullUser crontab
crontab -l -u <user>
Diagnostic flow
Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.
Guided decision tree is ready.
Steps with commands, expected output, and pass/fail branches.
Ranked root causes
Evidence checklist
- systemctl status shows cron is inactive/dead
- No CRON entries in syslog or journal
Confirm before fixing
systemctl is-active cron 2>/dev/null || systemctl is-active crond 2>/dev/nullCheck cron service state
Fix
systemctl start cron && systemctl enable cronStart and enable the cron daemon
Resolution runbook
Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.
systemctl status cron 2>/dev/null || systemctl status crond 2>/dev/nullCheck if cron is running
crontab -l -u <user> 2>/dev/nullVerify the crontab entries
grep CRON /var/log/syslog 2>/dev/null || journalctl -u cron --since '1 hour ago'Check cron execution logs
systemctl restart cron && systemctl enable cronStart and enable cron if it was down
Prevention
- Ensure cron daemon is enabled at boot (systemctl enable cron).
- Always include PATH in crontab files so scripts can find binaries.
- Use /etc/cron.d/ for system-level jobs and crontab -e for user-level jobs.
- Test cron jobs manually with the exact command before adding to crontab.
Related runbooks
Same stack, same failure family — worth a skim.
Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.