Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my server (that is running Debian) is getting these error every 5 minute

CRON[28355]: (CRON) error (grandchild #28357 failed with exit status 1) 

I can't figure out, where it comes from, so do anybody have an idea how to? Or how I can check it?
I have tried to show crontab jobs for all users, but there are no crontab jobs, that is running every 5 minute, so what could it be?

share|improve this question
Have you checked the cronjobs under /etc/crontab and /etc/cron.d as well? This smells like a cron job blowing up (if you crank up the debugging on cron itself it should tell you in the line above the error which program it tried to spawn) – voretaq7 Mar 7 '12 at 16:17
Thanks for the help :D I did not think about /etc/cron.d, but only checking for crontab -l -u <all users> – The87Boy Mar 7 '12 at 16:28
up vote 2 down vote accepted

Look in /etc/cron.d/ for additional crontabs run by root.

share|improve this answer
Thanks :D I saw, that filetraq was running every 5 minute, even though dpkg says it is not installed – The87Boy Mar 7 '12 at 16:23

This log line reveals PIDs of two processes:

  • a child process of crond daemon (pid 28355) which started the job
  • a grandchild who actually is the cron job (pid 28357)

When cron job is started the following line appears in the syslog:

Mar 7 06:45:01 gamma /USR/SBIN/CRON[28493]: (root) CMD /usr/bin/your_command_here

when cron job exits with nonzero status it will log the exact line you mentioned in your question. You can use grep on your syslog file to actually find which command was it:

# grep 28357 /var/log/syslog
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.