BeginnerIn-depth3 min readUpdated 2 Oct 2026

What is cron, and how do you read crontab syntax?

SHORT ANSWER

cron is a Linux service that runs commands on a schedule. Each crontab line has five time fields - minute, hour, day of month, month and day of week - followed by the command, so "30 2 * * 1-5 /home/ravi/backup.sh" runs the backup at 2:30 AM every Monday to Friday.

Explain it simply

Think of the alarms on your phone. You can set one for 6 AM on weekdays, another for every Sunday at 9 AM. cron is the alarm clock of a Linux machine, except instead of ringing it runs a command. The list of alarms for a user is called the crontab (cron table).

Example

Open your crontab with crontab -e, list it with crontab -l. Each line looks like this:

text

┌───────── minute (0-59)
│ ┌─────── hour (0-23)
│ │ ┌───── day of month (1-31)
│ │ │ ┌─── month (1-12)
│ │ │ │ ┌─ day of week (0-7, where 0 and 7 are Sunday)
│ │ │ │ │
* * * * *  command to run

Some real entries:

bash

30 2 * * 1-5  /home/ravi/backup.sh >> /home/ravi/backup.log 2>&1   # 2:30 AM, Mon-Fri
*/5 * * * *   /usr/local/bin/health-check.sh                        # every 5 minutes
0 9 1 * *     /home/ravi/send-invoice.sh                            # 9 AM on the 1st of every month
0 0 * * 0     /usr/bin/find /tmp -name "*.tmp" -mtime +7 -delete    # midnight every Sunday
15 10,18 * * * /home/ravi/sync.sh                                   # 10:15 AM and 6:15 PM daily

The symbols:

* means every value.
, gives a list: 10,18.
- gives a range: 1-5.
/ gives a step: */5 in the minute field means 0, 5, 10 and so on.

Many cron versions also accept shortcuts like @reboot, @daily and @hourly.

How it works

A background daemon (cron or crond) wakes up every minute, reads all crontabs and runs any job whose fields match the current time. Each user has their own crontab, edited only through crontab -e (which checks the syntax). System-wide jobs live in /etc/crontab and /etc/cron.d/, and those lines have an extra field for the user to run as.

A detail that surprises people: if both day of month and day of week are restricted (not *), the job runs when either matches. 0 9 1 * 1 runs on the 1st of the month and also on every Monday.

Real-world use

Nightly database backups and log rotation.
Clearing old temporary files.
Sending scheduled reports or reminder emails.
Renewing TLS certificates.

Common mistakes

Assuming your normal environment. cron runs with a very small PATH and few variables, so a script that works in your terminal may fail with "command not found". Use full paths like /usr/bin/python3, or set PATH= at the top of the crontab.
Losing output. Without >> file 2>&1 the output is mailed locally or discarded, and you never see the error.
Timezone confusion. Jobs run in the server's timezone, which on cloud machines is often UTC, not IST.
Unescaped %. In a crontab line, % means newline, so date +%F must be written as date +\%F.
Writing * 2 * * * when you meant "once at 2 AM". That runs every minute from 2:00 to 2:59; use 0 2 * * *.

What to say in the interview

"cron is the Linux job scheduler. A crontab line has five fields, minute, hour, day of month, month and day of week, followed by the command. Star means every value, commas give lists, hyphens ranges and slashes steps, so */15 * * * * runs every 15 minutes and 30 2 * * 1-5 runs at 2:30 AM on weekdays. I edit it with crontab -e, always use absolute paths because cron has a minimal environment, and redirect output to a log file with >> log 2>&1 so failures are visible."

Follow-up questions

Write a cron expression that runs at 11:45 PM every Friday.
Why does a script work manually but fail in cron?
What is the difference between cron and systemd timers?
How would you stop two runs of the same job overlapping? (Hint: flock.)

#linux #cron #scheduling #automation