What is a Cron Expression?
A cron expression is a string of five (or six, in some systems) fields that define when a scheduled task should execute. Developed in the 1970s for Unix systems, cron has become the universal standard for task scheduling across Linux, macOS, and even cloud platforms like AWS and Google Cloud.
The five fields represent:
- Minute (0-59): The minute of the hour when the job runs
- Hour (0-23): The hour of the day in 24-hour format
- Day of Month (1-31): Which day of the month
- Month (1-12): Which month of the year
- Day of Week (0-6): Which day of the week (0 = Sunday)
For example, 0 2 * * * means "run at 2:00 AM every day," while */15 * * * * means "run every 15 minutes." The asterisk (*) is a wildcard meaning "every" or "any value."
This tool eliminates the guesswork by letting you build expressions visually and immediately see when they'll execute.
Common Cron Expression Patterns
Here are the most commonly used cron patterns and what they mean:
* * * * *- Every minute (use cautiously!)*/5 * * * *- Every 5 minutes0 * * * *- Every hour at minute 00 0 * * *- Daily at midnight0 2 * * *- Daily at 2:00 AM (common for backups)0 9 * * 1- Every Monday at 9:00 AM0 0 1 * *- First day of every month at midnight0 0 * * 0- Every Sunday at midnight*/30 9-17 * * 1-5- Every 30 minutes during business hours (9 AM - 5 PM) on weekdays
Backups: Most production backups run at 0 2 * * * (2 AM) when server load is lowest.
Reports: Weekly reports often use 0 9 * * 1 (Monday 9 AM) to summarize the previous week.
Cleanup: Temporary file cleanup might run 0 */6 * * * (every 6 hours) to prevent disk fill-up.
How to Use Cron in Different Environments
Linux/macOS (crontab):
Edit your user's crontab with crontab -e, then add your cron expression followed by the command:
0 2 * * * /path/to/backup-script.sh
List current jobs: crontab -l
AWS CloudWatch Events / EventBridge:
AWS uses cron expressions with an additional sixth field for seconds. For example:
cron(0 2 * * ? *) - runs daily at 2 AM (the ? in day-of-week means "no specific value")
Kubernetes CronJobs:
In Kubernetes manifests, use standard 5-field cron syntax:
apiVersion: batch/v1
kind: CronJob
metadata:
name: backup-job
spec:
schedule: "0 2 * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: backup
image: backup-image:latest
GitHub Actions:
Schedule workflows using cron syntax in your YAML:
on:
schedule:
- cron: '0 2 * * *'
Each platform may have slight syntax variations, but the core 5-field pattern remains consistent.
Debugging Cron Jobs: Common Pitfalls
1. Time Zone Issues: Cron uses the server's local time zone, not UTC. If your server is in US Eastern (EST/EDT), 0 2 * * * runs at 2 AM Eastern, which is 7 AM UTC. Always verify your server's timezone with date or timedatectl.
2. PATH Environment: Cron jobs run with a minimal environment. Commands like npm, python, or git may not be in PATH. Always use absolute paths:
0 2 * * * /usr/bin/python3 /home/user/script.py
3. No Standard Output: Cron doesn't show output unless you redirect it. Append >> /var/log/cron.log 2>&1 to capture both stdout and stderr:
0 2 * * * /path/to/script.sh >> /var/log/backup.log 2>&1
4. Overlapping Jobs: If a job takes longer than its interval, it can overlap with the next execution. Use flock or similar locking mechanisms to prevent this.
5. Day-of-Month vs Day-of-Week: When both are specified (not *), the job runs when EITHER condition is met (OR logic, not AND). This often surprises users.
Testing Tip: Instead of waiting for your job to run, test the command manually first by copying it from your crontab and running it in your shell. This reveals PATH and permission issues immediately.