> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-13/linux/trick-0588.md).

# Identify Cron Job via File Timestamp

***

Monitor a file's modification timestamp to infer the existence and frequency of a cron job writing to it. This is useful when direct access to cron tables is restricted or the job is otherwise hidden.

Repeatedly check the file's timestamp to observe changes. For example, if a file named `date` in the current directory is being updated by a cron job, you could watch its timestamp:

```bash
watch -n 1 ls -l date
```

The `watch` command runs a command repeatedly, displaying its output. The `-n` option specifies the update interval in seconds. Using `watch -n 1` will refresh the output of `ls -l date` every second, showing the file's permissions, owner, size, and critically, its last modification timestamp.

If the timestamp updates periodically (e.g., every minute as noted in the example), it strongly indicates a cron job is executing a script that modifies this file. Another example using a different interval and a specific file path might be:

```bash
watch -n 5 ls -l /path/to/file
```

This would check the file's status every 5 seconds.

A common scenario where this technique is applicable is when a cron job appends its output to a log file using redirection like `>>`. For instance:

```bash
command_run_by_cron >> /path/to/cron.log 2>&1
```

In this case, monitoring the modification time of `/path/to/cron.log` using `watch` can reveal when the cron job is running. Checking for the existence or modification of a file that the cron job interacts with is a valid technique for monitoring its activity.