I'm looking for a way to log crontab file writes. A friend of mine pranked me, and did something that occasionally adds */5 * * * * say "deranged" "The current time is `date`"

I haven't been able to identify a pattern yet: Nothing for 2 weeks, then twice in 5 minutes. I'm trying to find the process that writes to the crontab. Is there any way to log crontab writes to a file so I can catch this thing?

  • 1
    Is your friend named Moshen?
    – bmike
    Mar 3, 2014 at 22:53
  • Nope :). It's not on system restart or any common terminal arguments.
    – Arion
    Mar 4, 2014 at 21:23

1 Answer 1


Open terminal and run this:

sudo fs_usage | grep cron

I'd run it using tmux or screen so that you can detach and check later. Depending on how many cron jobs you have, this could generate a lot of messages and you'll want to not run it where a runaway process could cause harm. (backup, check filesystems for space, etc...)

You can also use mdfind to see if you can locate the file/script/package that is calling crontab (perhaps) and correlate that with the times when the actual filesystem changes are happening.

mdfind crontab
  • No luck with mdfind. It's happening more frequently now, so fs_usage will likely return something soon.
    – Arion
    Mar 4, 2014 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .