Cron Beyond the Basics: Environment, Locking, and Logging

No expansion in variable lines — a crontab line like PATH=$PATH:/opt/bin does not expand $PATH; the value is taken literally. Write the full list out.

Time zones — cron uses the system time zone. cronie (RHEL, Fedora) also honours a CRON_TZ= line for the entries that follow it; check man 5 crontab on other implementations before relying on it.

The trailing newline — the last line of a crontab must end with a newline. Without one, crontab -e refuses to install the file or the final entry is ignored, depending on the implementation.

Where to put lock files — /run/lock is on tmpfs and cleared at boot, which is what you want. It is usually world-writable on Debian and Ubuntu but root-only on RHEL and Fedora, so non-root jobs need a directory the job user owns.

Avoid /tmp for long-held locks — systemd-tmpfiles deletes old files from /tmp. If the lock file is removed while held, the next run creates a new file, locks that, and you have two instances again.

Inherited descriptors keep the lock — anything the script starts in the background inherits fd 9 and holds the lock after the script exits. Close it for such children with 9>&-.

Exit code 124 — means the time limit was hit. With -k, a process that needed SIGKILL exits 137. Log these distinctly — a job that times out every night is failing, even if nothing else complains.

Order matters — flock outside, timeout inside: the lock is held for the whole bounded run and released when timeout exits.

2>&1 placement — cmd 2>&1 >> file points stderr at the old stdout — cron's mail — before stdout is redirected. Always write >> file 2>&1.

Pipes hide exit codes — in backup.sh | logger, the job's status is logger's, which is almost always 0. Use systemd-cat, or log from inside the script, when you need the real exit code.

Log from inside the script — in bash, exec > >(logger -t backup) 2>&1 at the top sends everything that follows to the journal while the script keeps its own exit status.

Quiet unless it fails — chronic from the moreutils package swallows output when the command succeeds and prints it all when it fails. Combined with MAILTO, you get mail only for failures.

Rotate file logs — a log file that is appended to on each run needs a logrotate entry. Because each run reopens the file, plain rotation works without copytruncate.

/etc/cron.d naming — on Debian and Ubuntu, files in /etc/cron.d whose names contain a dot are ignored, so app works and app.cron silently does not. Files must be owned by root and not group- or world-writable.

Lock directory for non-root users — as written, the wrapper locks in /run/lock. On RHEL and Fedora that directory is root-only, so point it at a directory the deploy user owns.

Heartbeats catch silence — logs and mail tell you a job failed. Only a heartbeat that stops arriving tells you a job never ran at all — crond stopped, the crontab was overwritten, the host was rebuilt.

When to switch to systemd — systemd timers give you the lock (a service cannot start twice), journal logging, RandomizedDelaySec= and Persistent=true catch-up without a wrapper. If you are on systemd anyway, the systemd generator builds the unit pair, and our cron expressions guide helps translate the schedule.