Crontab + Journalctl: extra messages

Question

Disclaimer: the following describes things done for learning purposes in CentOS 7.

I want to redirect the output of a crontab job to journalctl. When I have the following record, it just sends a mail to root user.

# crontab -l
* * * * * echo "Hello World"

I've read about systemd-cat which can execute a process, piping it's output to the journal. So I made it like this:

# crontab -l 
* * * * * systemd-cat -t "cron-bot" echo "Hello World"

But now I receive two log messages every minute:

{
  "_TRANSPORT" : "syslog",
  "SYSLOG_IDENTIFIER" : "CROND",
  "MESSAGE" : "(root) CMD (systemd-cat -t \"cron-bot\" echo \"Hello World\")",
  "_CMDLINE" : "systemd-cat -t cron-bot echo Hello World",
}
{
  "_TRANSPORT" : "stdout",
  "SYSLOG_IDENTIFIER" : "cron-bot",
  "MESSAGE" : "Hello World",
  "_COMM" : "echo",
}

or, in short format:

Sep 06 08:58:01 hostname CROND[13417]: (root) CMD (systemd-cat -t "cron-bot" echo "Hello World")
Sep 06 08:58:01 hostname cron-bot[13417]: Hello World

Can someone explain this behavior to me? I'd like to receive only the job ouput (cron-bot[13417]: Hello World) and do not receive the command itself (CROND[13417]: ...) but mostly I'm asking this to learn more about the topic.

Answer 1

cron logs each command it runs to syslog, and on your system the syslog ends up in the journal as well. As far as I’m aware, cron doesn’t have an option to disable that, but you can hide those messages by selecting only those journal messages received via stdout:

journalctl -u cron _TRANSPORT=stdout

(-u cron might be -u crond or something like that on CentOS, I’m not sure.)

Answer 2

The log entry for "SYSLOG_IDENTIFIER" : "CROND" is showing you that cron is executing a command and what command that is.

The log entry for "SYSLOG_IDENTIFIER" : "cron-bot" is showing your your script output.

Since you used the tagging ability of journalctl with including -t "cron-bot" you can pull your desired output by filtering what you are pulling from journalctl. That -t is what sets the SYSLOG_IDENTIFIER. (I think you already knew that 😉)

Something like this is what I've used many times to get specific logs out of the journal:

journalctl -fet "cron-bot"

That should display just your output and not the cron/crond output of the journal.

https://man7.org/linux/man-pages/man1/journalctl.1.html

-f, --follow
  Show only the most recent journal entries, and continuously
  print new entries as they are appended to the journal.

-e, --pager-end
  Immediately jump to the end of the journal inside the implied
  pager tool. This implies -n1000 to guarantee that the pager
  will not buffer logs of unbounded size. This may be
  overridden with an explicit -n with some other numeric value,
  while -nall will disable this cap. Note that this option is
  only supported for the less(1) pager.

-t, --identifier=SYSLOG_IDENTIFIER
  Show messages for the specified syslog identifier
  SYSLOG_IDENTIFIER.
  This parameter can be specified multiple times.