What is a cron job?

A cron job is a scheduled command that runs at fixed times or intervals on Unix-like systems. The schedule is one line — five space-separated fields called a cron expression — telling the cron daemon when to fire. Linux, macOS, Kubernetes, GitHub Actions and AWS use the same syntax.

Anatomy of a cron job

A crontab entry has two halves — the schedule (when) and the command (what):

*/5 * * * *  /usr/local/bin/backup.sh
└────┬────┘  └─────────┬─────────────┘
 Schedule         Command

The schedule itself is five fields, in this order:

* means “any value”, */N means “every N units”, and a comma separates a list (1,15 matches the 1st and 15th). That covers most cron expressions you’ll meet.

How do I read a cron expression?

Translate field-by-field, left to right:

• 0 9 * * 1 → minute 0, hour 9, any day-of-month, any month, day-of-week 1 → Mondays at 9:00.
• 0 0 1 * * → minute 0, hour 0, day 1 of the month, any month, any day-of-week → midnight on the 1st of every month.
• */15 * * * * → every 15 minutes, every hour, every day → every quarter hour, around the clock.
• 0 2 * * 0 → minute 0, hour 2, any day-of-month, any month, Sunday → Sundays at 2 AM.

If you can’t decode an expression at a glance, paste it into the Cron Expression Builder — it shows the human-readable description and the next 5 fire times.

What kinds of work do cron jobs do?

Anything that needs to run on a schedule rather than in response to user actions:

Where do cron jobs actually run?

The same 5-field syntax shows up everywhere — once you learn it, it transfers across platforms:

• Linux & macOS — the cron (or crond) daemon reads /var/spool/cron/crontabs/<user>, plus /etc/crontab and /etc/cron.d/ for system jobs. Edit your user crontab with crontab -e.
• Kubernetes — CronJob resources schedule pods. Same syntax in the schedule: field, but concurrencyPolicy (Allow / Forbid / Replace) determines what happens when a previous run is still going. The Kubernetes CronJob schedule generator walks through the full manifest with timezone, concurrency and starting-deadline fields.
• GitHub Actions — on: schedule: with a cron: key. UTC always, with a 5-minute minimum granularity enforced by the runner.
• AWS EventBridge / Scheduler — wrapped in cron(...) with a sixth year field and ? for one of day-of-month or day-of-week. See the AWS EventBridge guide for the full ruleset.
• Most CI runners (GitLab, Jenkins, CircleCI) — each adds small dialect tweaks but builds on the same 5-field core.

Common mistakes when writing cron jobs

Commands don’t pick up your interactive shell. Cron runs commands with a minimal PATH and no ~/.bashrc, ~/.zshrc or login profile. Either use absolute paths (/usr/local/bin/python3 /opt/scripts/run.py) or set PATH= at the top of the crontab. The number-one reason a cron job “works on my terminal but not in cron” is environment.

Output goes to email by default — and email usually goes nowhere. Standard cron mails any stdout/stderr to the local mailbox. On modern systems with no mailer configured, the output is silently dropped. Always redirect: >> /var/log/myjob.log 2>&1.

Day-of-month and day-of-week interact weirdly. When both are specified (0 9 15 * 1) Unix cron treats it as OR — runs on the 15th of the month and every Monday, not the intersection. To get “Mondays at 9 AM”, leave day-of-month as *. AWS EventBridge sidesteps this by requiring ? for one of the two fields.

For ready-to-paste expressions covering specific intervals, see common cron schedules, or build a custom expression with the Cron Expression Builder.