Cron Expression Syntax: A Complete Guide with Examples

What Is Cron and How Does It Work?

Cron is a time-based job scheduler found in Unix-like operating systems (Linux, macOS, BSDs). It runs in the background as a daemon and executes commands or scripts at specified intervals. The name comes from the Greek word "chronos" (time).

Every minute, the cron daemon checks its list of scheduled tasks (stored in crontab files) and runs any that match the current time. This makes cron ideal for recurring tasks like database backups, log rotation, sending scheduled emails, cleaning temporary files, and triggering data pipelines.

Cron expressions define when a job runs using a compact 5-field syntax. Each field represents a time unit (minute, hour, day, month, weekday). While the syntax is powerful, it can be cryptic — which is why tools like our Cron Expression Generator let you build expressions visually and see exactly when they will fire.

The 5-Field Cron Format Explained

A standard cron expression has 5 fields separated by spaces. Each field specifies allowed values for one time component:

┌───────────── minute (0-59)
│ ┌───────────── hour (0-23)
│ │ ┌───────────── day of month (1-31)
│ │ │ ┌───────────── month (1-12 or JAN-DEC)
│ │ │ │ ┌───────────── day of week (0-7 or SUN-SAT, 0 and 7 = Sunday)
│ │ │ │ │
* * * * *

Key detail: Both 0 and 7 represent Sunday in the day-of-week field. This is a historical quirk — some systems use 0 (the POSIX standard), others use 7. Both are universally accepted.

Special Characters and Operators

• Asterisk (*) — Matches every possible value. * * * * * runs every minute.
• Comma (,) — Lists multiple values. 1,15 * * * * runs at minute 1 and minute 15 of every hour.
• Hyphen (-) — Defines a range. 0 9-17 * * * runs every hour from 9 AM to 5 PM.
• Slash (/) — Defines a step/interval. */10 * * * * runs every 10 minutes. 5/15 * * * * runs at minutes 5, 20, 35, 50.
• L (Last) — Used in day-of-month and day-of-week. 0 0 L * * runs on the last day of every month. 0 0 * * 5L runs on the last Friday.
• W (Weekday) — Nearest weekday to a given day. 0 0 15W * * runs on the nearest weekday to the 15th.
• Hash (#) — Nth occurrence of a weekday. 0 0 * * 1#2 runs on the second Monday of the month.

Not sure your expression is correct? Use our Cron Expression Generator to see the next 10 scheduled run times and verify the pattern matches your intent.

20 Common Cron Schedules (Copy-Paste)

These cover the vast majority of scheduling needs. For more complex schedules, combine multiple operators or use our visual Cron Generator to build the expression interactively.

Platform Differences: Linux vs AWS vs Kubernetes

Standard Linux Cron (crontab)

Uses the classic 5-field format. Edit with crontab -e. Runs in the server's local timezone. Does not support seconds. Jobs run under the user's account that created the crontab.

# Edit your crontab
crontab -e

# List current cron jobs
crontab -l

# Example: backup database every day at 3 AM
0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

AWS EventBridge (CloudWatch Events)

AWS uses a 6-field format with a mandatory year field: cron(minutes hours day-of-month month day-of-week year). Always runs in UTC. Uses ? instead of * for day-of-month or day-of-week (you must use ? for one of them).

# AWS: Every weekday at 9 AM UTC
cron(0 9 ? * MON-FRI *)

# AWS: Every 5 minutes
rate(5 minutes)

# Note: AWS requires ? in either day-of-month or day-of-week

Kubernetes CronJobs

Uses standard 5-field cron syntax. Timezone is set by the cluster (or per-job with timeZone field since Kubernetes 1.27). Important: Kubernetes may create duplicate jobs or miss executions around clock changes. Always design idempotent jobs.

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-report
spec:
  schedule: "0 8 * * *"
  timeZone: "America/New_York"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: report
            image: myapp:latest
            command: ["./generate-report.sh"]
          restartPolicy: OnFailure

Understanding file permissions is important when setting up cron jobs — scripts need execute permission. Use our Chmod Calculator to set the correct permissions on your cron scripts.

Troubleshooting Cron Jobs

When cron jobs fail silently (and they will), check these common issues:

• PATH is minimal — Cron runs with a stripped-down PATH (/usr/bin:/bin). Always use absolute paths for commands: /usr/local/bin/node instead of node.
• Environment variables are missing — Your .bashrc and .profile are not sourced. Define needed variables at the top of your crontab or source them in the script.
• No output capture — By default, cron emails output to the user. If mail is not configured, output is lost. Always redirect: >> /var/log/myjob.log 2>&1
• Permission denied — The script must be executable (chmod +x script.sh) and owned by the crontab user.
• Timezone confusion — System cron uses the server's timezone. If your server is UTC but you scheduled for "9 AM" expecting local time, the job runs at the wrong hour.
• Overlapping executions — If a job takes longer than its interval, multiple instances pile up. Use flock to prevent overlap: flock -n /tmp/myjob.lock /path/to/script.sh

# Debugging template: log everything, use absolute paths, lock
SHELL=/bin/bash
PATH=/usr/local/bin:/usr/bin:/bin

# Run daily at 3 AM with overlap protection
0 3 * * * flock -n /tmp/backup.lock /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

Frequently Asked Questions

Related Articles

Related Tools