What is a cron job? A beginner’s guide with examples

A cron job is a command that a Unix or Linux system runs automatically on a schedule: every night at 2 am, every five minutes, every Monday morning. Cron is the scheduler that runs them, and each user’s list of jobs is called a crontab. Backups, report emails, clean-up scripts, certificate renewals and data imports are typically cron jobs.

A first cron job

Open your crontab with crontab -e and add one line:

30 2 * * * /usr/local/bin/backup.sh

That runs backup.sh every day at 02:30. crontab -l lists your jobs. Each line is a schedule of five fields followed by the command.

The five fields

┌───────── minute (0–59)
│ ┌─────── hour (0–23)
│ │ ┌───── day of the month (1–31)
│ │ │ ┌─── month (1–12)
│ │ │ │ ┌─ day of the week (0–6, Sunday is 0; 7 is also Sunday on most systems)
│ │ │ │ │
* * * * *  command

• * means every value.
• */5 means every fifth value: */5 * * * * is every five minutes.
• 1-5 is a range and 1,15 a list: 0 9 * * 1-5 is 09:00 on weekdays.

One trap: when both the day-of-month and day-of-week fields are set, cron runs the job when either matches, not both. 0 9 1 * 1 runs on the 1st of the month and on every Monday.

To check an expression before you trust it, paste it into the cron expression explainer: it says in words when the job runs and lists the next run times, or builds the expression from a schedule you choose.

Why a job works by hand but not in cron

• A smaller environment. Cron runs commands with a minimal PATH and without your shell profile, so a command found when you type it may not be found by cron. Use full paths, or set PATH at the top of the crontab.
• Another time zone. Cron uses the server’s time zone, which on cloud servers is often UTC. A job for 09:00 London time runs an hour off for half the year unless the server is set to that zone.
• % is special. In a crontab line, % means a new line; write \% in a date +%F command.
• Output disappears. Cron mails the output to the local user, which on most servers nobody reads. Redirect it to a log: … >> /var/log/backup.log 2>&1.
• Runs overlap. If a five-minute job sometimes takes seven, two copies run at once. flock -n /tmp/import.lock command skips a run while the previous one is still going.

Cron outside a Linux server

The same five-field expressions schedule work in many other places: Kubernetes CronJobs, GitHub Actions schedule triggers (always in UTC), and the schedulers of most cloud platforms. systemd timers are the alternative on modern Linux, with their own calendar syntax.

The real problem: knowing that it ran

When a cron job fails, nothing tells you. The server stays up, the website works, and the backup that stopped three weeks ago is discovered the day you need it. The scheduler may have stopped, the script may fail on a full disk, or the server may have been rebuilt without its crontab.

A heartbeat monitor turns that silence into an alert. The job calls a URL when it finishes successfully, and if no call arrives within the expected interval, you are alerted:

30 2 * * * /usr/local/bin/backup.sh && curl -fsS -m 10 <your heartbeat URL>

The && matters: the ping is sent only if the backup succeeded. Cron job monitoring: detect the job that never ran goes further, into where to place the ping and how to tell a job that finished from one that did useful work.