ShellSpells
  • 🧙‍♂️Welcome!
    • ShellSpells
    • FAQs
    • License & Disclaimer
  • 🐧Linux
    • System Ops
      • Transcripts
      • Help
      • System Info
        • Date/Time
        • System Details
        • Patches & Updates
        • Init System Identification
        • Hostname / Host ID
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Shares
        • Packages
        • Connected Devices
        • Kernel Modules (Drivers)
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Jobs
        • Enumerate
        • Modify
      • Processes
        • Enumerate
        • Modify
        • Custom Script and Shared Object
        • Process I/O Redirection
      • Services
        • Enumerate
        • Modify
        • Create a Service
      • Startup/Boot Scripts
        • Enumerate
        • Modify
      • Security
        • Antivirus
        • Firewall
        • SSH Keys
      • History & Logs
        • History
        • Logs
    • File Ops
      • Search
        • Filename
        • Content
        • Users (Owners)
        • Time
        • Size
        • Permission
        • Hidden Files
        • Inode
        • Find + Exec
        • Notes
      • Enumerate Metadata
      • Modify Metadata
      • Read Content
      • Modify Content
      • Extract Content
      • Sort / Compare / Count
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
    • Terminal Ops
      • Keyboard Shortcuts
      • Tmux Shortcuts
  • 🪟Windows
    • System Ops
      • Transcripts
      • Help
      • System Info
        • One-liners
        • Date/Time
        • System Details
        • Hotfixes
        • Domain or Workgroup
        • Data Execution Prevention
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Installed Software
        • Drivers
        • Shares
      • Registry
        • Enumerate
        • Modify
        • Forensically Relevant Keys
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Tasks
      • Processes
        • Enumerate
        • Modify
      • Services
        • Enumerate
        • Modify
      • Autorun / Startup
        • Enumerate
        • Modify
      • Security
        • Permissions
          • Enumerate
          • Page
        • Antivirus
        • Firewall
          • Enumerate
          • Modify
        • Audit Policies
        • Remoting
          • Enumerate
          • Modify
          • Registry Locations
        • Stored Credentials
      • Remote Command Execution
      • Active Directory
        • Enumerate
        • Modify
      • History & Logs
        • History
        • Logs
      • PowerShell Config
      • Scripting
      • WMIC Notes
    • File Ops
      • Search
        • Filename
        • Time
        • Size
        • Permissions
        • Attributes
        • Wildcarding
      • Enumerate Metadata
        • One Liners
        • Users (Owners)
        • Timestamps
        • Size
        • Permissions
        • Attributes
      • Modify Metadata
        • Change Owner
        • Timestamps
        • Size
        • Attributes
      • Read Content
      • Modify Content
        • Overwrite
        • Insert
        • Append
        • Replace / Remove
        • Convert Case
        • Alternate Data Streams
      • Extract Content
      • Sort / Compare / Count
        • Sort
        • Count
        • Compare
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
      • Output Formatting / Filtering
      • File Formatting
      • Operators
  • ⛓️Network
    • Traffic Manipulation
      • iptables
        • Option List
        • General Commands
        • Filter Tables
        • NAT
        • Mangle
        • Filter for SSH Traffic (Example)
      • nftables
    • Packet Capture
      • Syntax
      • TCPDump Examples
    • Packet Analysis
      • Wireshark
  • 🚗Maneuver
    • SSH
    • Control Sockets
    • RDP
    • Windows Port Proxy
  • 🛩️Data Transfer
    • SCP
    • FTP
    • Netcat
      • Netcat Relays
    • Server Interactions
    • Alternate Methods
  • 🪄REGEX
    • Examples
Powered by GitBook
On this page
  • Cron Jobs
  • Systemd Timers
  • Anacron
  • Spool Directory
  • Analyze Timestamps
  • at
  • Other Tools

Was this helpful?

  1. Linux
  2. System Ops
  3. Scheduled Jobs

Enumerate

Cron Jobs

find /etc/cron* -print

Shows all crontab files across the system (requires root privileges).

crontab -l

Lists the current user's crontab entries.

crontab -u <username> -l

Lists crontab entries for a specific user (requires superuser privileges).

cat /etc/crontab

Displays the system's main crontab, which might contain system-wide scheduled tasks.

ls -l /etc/cron*

Lists system-wide crontabs directories and files (requires root privileges).

ls /etc/cron.d/

Lists cron job files in the /etc/cron.d/ directory for individual cron jobs.

ls /etc/cron.hourly/

Lists scripts scheduled to run every hour.

ls /etc/cron.daily/

Lists scripts scheduled to run daily.

ls /etc/cron.weekly/

Lists scripts scheduled to run weekly.

ls /etc/cron.monthly/

Lists scripts scheduled to run monthly.

cat /etc/anacrontab

Displays tasks scheduled with anacron for systems that don't run 24/7.

systemctl list-timers

Lists active systemd timers, showing schedules and last trigger times.

ls /var/spool/cron/crontabs/

Lists the directories for user-specific cron jobs, typically requires superuser access.

Show crontabs for each user:

for user in $(cut -f1 -d: /etc/passwd); do echo $user >> /tmp/crontabs; crontab -u $user -l >> /tmp/crontabs; done

Prints the contents of all system-wide cron job files:

find /etc/cron.* -type f -exec cat {} +

Prints the contents of all user-specific cron jobs, requires superuser access:

find /var/spool/cron/crontabs -type f -exec cat {} +

Lists all current users and their cron jobs (requires root privileges):

who | awk '{print $1}' | xargs -n1 crontab -u -l

Systemd Timers

find /etc/systemd/system -name "*.timer"

Lists all timer unit files (requires root privileges).

systemctl list-timers

Lists all active timers along with their next scheduled execution time and the last time they were triggered.

systemctl list-timers --all

Lists all timers, including inactive ones, showing their next scheduled execution time and the last time they were triggered.

systemctl list-timers --state=active

Lists only active timers that are currently scheduled to run.

systemctl list-timers --state=inactive

Lists only inactive timers that have not yet been triggered.

systemctl list-timers --state=disabled

Lists only disabled timers that are not scheduled to run at all.

systemctl list-timers grep <keyword>

Filter the output based on keywords in the timer unit names or descriptions.

systemctl status <timer_name>

Shows detailed information about a specific timer.

systemctl cat <timer_name>

Displays the full unit file configuration for a specific timer, showing how it's configured to run.

systemctl list-unit-files --type=timer

Lists all installed timer unit files, showing their enabled/disabled state.

journalctl -u <timer_name>

Shows the journal logs for a specific timer, useful for troubleshooting or checking what the timer did when it last ran.

systemctl show <timer_name>

Shows low-level details about a specific timer unit in a property=value format.

Anacron

anacron -t

Displays tasks scheduled by anacron and their next run times.

anacron -l

Shows logs of previous anacron runs.

find /etc/anacrontab -print

Locates the main anacron configuration file (requires root privileges).

crontab -l

(Not an Anacron command, but commonly used) List the tasks in the current user's Anacrontab.

cat /etc/anacrontab

Anacrontab location.

Spool Directory

ls -l /var/spool/anacron<username>

This directory contains individual files for each user's Anacron jobs. The file names correspond to the time intervals used by Anacron (e.g.,hourly,daily,weekly,monthly)

ls -l /var/spool/anacron/root

Contains Anacron jobs for the root user

Analyze Timestamps

ls -l /var/log/anacron Anacron logs its activity here.

Look for lines starting with "running job file" followed by the filename and username.

The timestamp indicates the last execution time.

at

atq

Lists jobs scheduled using the at command.

atq -la

Similar to atq, but might provide more detailed information like priority and working directory.

atq -v

Provides more detailed information about each job, including its ID, time, command, and user.

atq -u <user>

Filters jobs for a specific user.

at -c <job number>

Shows the command for a specific job.

ls -l /var/spool/cron/atjobs

Lists the at jobs directory to view job files, requires superuser access.

ls -l /var/spool/at

Another common location for at job files on some Unix systems, requires superuser access.

ls -l /var/spool/cron/<username>

User jobs stored here.

/etc/at.allow or /etc/at.deny

Controls who can use the at command for scheduling jobs.

Lists job numbers along with their owners by extracting user information from job details:

sudo atq | awk '{print $1}' | xargs -I {} sudo at -c {} | grep '^<'

Loops through all pending jobs for the current user, displaying details of each:

for job in $(atq | awk '{print $1}'); do at -c $job; done

Other Tools

Command
Description

batch -l

Displays jobs submitted with the batch command (if available).

PreviousScheduled JobsNextModify

Last updated 1 year ago

Was this helpful?

🐧