Schedulers
cron & systemd timers
The scheduler with no database. Reads crontabs, timer units and journal history.
Plenty of production ETL is a shell script in a crontab. It has no metadata database, no run history beyond whatever the script itself logged, and no notion of success or failure that anything else can observe.
systemd timers are a considerable improvement — the journal records start, exit status and output for every invocation — and they are still frequently overlooked, because nobody thinks of a timer unit as part of the data platform.
What Decim reads from cron & systemd timers
Every item below is read-only, and each is a specific view, endpoint or file rather than a category of access. If something here is unacceptable in your environment, it can be removed from the query catalogue — see the agent for how that works.
| What | From | Why it matters |
|---|---|---|
| User crontabs | /var/spool/cron/crontabs/* | Per-user scheduled commands |
| System crontabs | /etc/crontab, /etc/cron.d/* | System-wide entries, with a user field |
| Periodic directories | /etc/cron.{hourly,daily,weekly} | Scripts run by run-parts |
| Timer units | systemctl list-timers --all | Next and last elapse per timer |
| Service units | systemctl cat <unit> | The command, its user, and its environment |
| Run history | journalctl -u <unit> | Start, exit status and captured output |
| Exit status | systemctl show -p ExecMainStatus | Last exit code for a service |
Permissions required
Written out in full, because "read-only access" is not a specification. Nothing below grants the ability to write, and row access is requested only on the specific tables you name.
# Read-only. The agent runs as its own unprivileged user.
useradd --system --shell /usr/sbin/nologin decim-agent
# Journal access without root: membership of systemd-journal is enough
# to read unit logs.
usermod -aG systemd-journal decim-agent
# Crontabs are root-owned and mode 600. Grant read via ACL rather than
# widening the mode, so the change is explicit and auditable.
setfacl -m u:decim-agent:r /etc/crontab
setfacl -Rm u:decim-agent:r /etc/cron.d
# Application log directories, read-only.
setfacl -Rm u:decim-agent:rX /var/log/etlWhat it builds
What this source contributes to the pipeline topology and to the evidence available during an investigation:
- Scheduled work and its cadence — the control layer for a stall with a clock
- The command line actually being run, including its arguments
- Run history and exit status, where systemd is used
- Which user and environment a job executes under
Nodes learned from a definition are marked declared; nodes observed running are marked observed; nodes both declared and observed are verified. Where two sources disagree, the disagreement is recorded as a drift note rather than resolved silently.
Failure modes it surfaces
What this source is uniquely good at proving — and, just as usefully, at disproving. An investigation that can refute a hypothesis cheaply is worth as much as one that confirms it.
| Failure mode | The signal |
|---|---|
| Job stopped running | Timer disabled, or crontab line commented out |
| Overlapping invocations | A run starting before the previous one finished |
| Silent failure | Non-zero exit with output discarded to /dev/null |
| Environment difference | PATH or locale differing from an interactive shell |
Limits
What this integration cannot tell you. Stated because an investigation that overstates its sources produces confident wrong answers, which is worse than an honest blocked.
- Plain cron records nothing about a run — no start time, no duration, no exit code
- The agent needs to be on the host, or on a host that shares the log volume
- A script's real behaviour is in the script, which may not be in source control either
Related integrations
- SQL Server Agent — Job steps are rows in msdb, not files in git. Reads sysjobs, sysjobsteps and sysjobhistory.
- Apache Airflow — The metadata database holds connections, variables, pools and manual state — none of it in git.
- Custom services — No API and no metadata database — structured logs, config files and the tables they write to.
See all integrations, or how the sources are combined into one graph.
Get started
Investigating a cron & systemd timers pipeline?
Bring an incident you already know the answer to. If Decim gets it wrong, that is a more useful demo than one where it doesn't.