I needed to investigate why a script was being run, and I was pretty sure cron was launching it. The problem was, little useful information was being logged, and no one was sure how it had been set up or what user it was under. Although launchd is now the preferred mechanism on Mac OS for these kinds of things, you’ll still see many systems where cron is being used.
First, you want to become the root user. The following Terminal command is one way to accomplish this:
sudo -s
From here, one option is dump the contents of all files in /usr/lib/cron/tabs:
cat /usr/lib/cron/tabs/*
This might be a bit messy, and doesn’t show which user the entries belong to without tracing back to the original file. A cleaner way to do this is in bash is:
for user in $(dscl . list /Users); do echo $user; crontab -u $user -l; echo; done
Don’t forget to also check in /etc/periodic and use the atq command for other places that cron like jobs could be configured.
Finally, I have had issues on Linux systems where a phantom cron entry persists, even after it has been removed using the crontab command. For this, I had to restart the crond process to clear out the old entry.