Everything you need to read, write, and debug cron expressions — from the basic Linux crontab format to advanced Kubernetes and AWS patterns.
A cron job is a scheduled task on Unix-like operating systems (Linux, macOS) that runs automatically at specified times. The name comes from Chronos, the Greek god of time. The program that manages these scheduled tasks is called the cron daemon (crond), and it reads scheduled tasks from a configuration file called a crontab (cron table).
Cron jobs are used for an enormous range of automated tasks: database backups, log rotation, sending scheduled emails, clearing caches, running reports, syncing data from APIs, and even defining the Kubernetes CronJob schedule syntax. If it needs to happen on a schedule, cron probably handles it.
A cron expression is the schedule string that tells cron when to run your task. Learning to write them correctly is a fundamental skill for anyone who works with servers, DevOps, or cloud platforms.
crontab command). Cron job = a single scheduled task entry in the crontab. These terms are often used interchangeably in practice.
Every standard cron expression contains exactly 5 fields, separated by spaces. Together, they define the complete crontab format explained schedule for when a command should run:
# The 5-field structure: ┌───────────── minute (0 - 59) │ ┌───────────── hour (0 - 23) │ │ ┌───────────── day of month (1 - 31) │ │ │ ┌───────────── month (1 - 12) │ │ │ │ ┌───────────── day of week (0 - 7, Sun=0 or 7) │ │ │ │ │ * * * * * command_to_execute
The minute field specifies which minute(s) of the hour the job should run. 0 means at the top of the hour (:00), 30 means at the half hour (:30), and * means every minute. You can also use */5 to mean every 5 minutes, or 15,45 to mean at :15 and :45.
The hour field uses 24-hour time. 0 = midnight, 9 = 9 AM, 13 = 1 PM, 23 = 11 PM. Use */2 for every 2 hours, 8-17 for business hours (8 AM to 5 PM), or * for every hour.
This field specifies which day(s) of the month to run. 1 = first day, 15 = 15th, L = last day of the month (not all implementations). Be careful with months that have fewer than 31 days — if you specify 31, the job won't run in February, April, June, September, or November.
Specifies which month(s). You can use numbers (1–12) or 3-letter abbreviations (JAN, FEB, MAR, APR, MAY, JUN, JUL, AUG, SEP, OCT, NOV, DEC). Use 1,4,7,10 for quarterly (Jan/Apr/Jul/Oct) or * for every month.
Specifies which day(s) of the week. Both 0 and 7 represent Sunday. You can use numbers or abbreviations: SUN, MON, TUE, WED, THU, FRI, SAT. Use 1-5 for Monday through Friday (weekdays), or 6,0 for Saturday and Sunday (weekends).
0 9 1 * 1 runs on the 1st of every month AND every Monday. This is a common source of confusion — use one or the other when you want precise control.
Cron expressions support several special characters beyond simple numbers. Understanding these unlocks the full expressive power of cron syntax.
Many cron implementations support convenient shorthand strings that replace the entire 5-field expression. These are much more readable than the numeric format for common schedules.
When you need to figure out how to read cron expression format for Linux and Kubernetes, use this simple reading framework. Parse each field from left to right, translating each value into plain English, then combine them:
# Example: 30 9 * * 1-5 30 = at minute :30 9 = at 9 AM (hour 9) * = any day of month * = any month 1-5 = Monday through Friday (days 1 to 5) Result: Every weekday at 9:30 AM
# Example: 0 0 1,15 * * 0 = at minute :00 0 = at midnight (hour 0) 1,15 = on the 1st and 15th * = every month * = any day of week Result: At midnight on the 1st and 15th of every month
These are the patterns you'll see and use most often in production systems. Memorize these and you'll be able to handle 90% of scheduling requirements.
| Expression | Meaning | Notes |
|---|---|---|
| * * * * * | Every minute | Most frequent possible schedule |
| */5 * * * * | Every 5 minutes | Health checks, polling |
| */15 * * * * | Every 15 minutes | Frequent sync tasks |
| 0 * * * * | Every hour at :00 | Hourly aggregation |
| 0 0 * * * | Daily at midnight | Nightly jobs |
| 0 2 * * * | Daily at 2 AM | Database backups (low traffic) |
| 0 9 * * 1-5 | Weekdays at 9 AM | Business day start |
| 0 17 * * 5 | Friday at 5 PM | End-of-week reports |
| 0 0 1 * * | Monthly, 1st at midnight | Monthly billing jobs |
| 0 0 * * 0 | Weekly on Sunday midnight | Weekly maintenance |
| 0 0 1 1 * | Annually, Jan 1 midnight | Yearly archival |
| 0 0 1 1,4,7,10 * | Quarterly, 1st of quarter | Q1/Q2/Q3/Q4 jobs |
Paste any cron expression into CronRead and instantly get a human-readable description, the next 5 scheduled run times, and real-time validation.
Validate Your Cron Expression →AWS EventBridge uses an extended cron syntax with 6 fields instead of 5. The extra field is Year, appended at the end. Additionally, AWS wraps the expression in a cron() function.
# AWS EventBridge format: cron( Minutes Hours Day-of-month Month Day-of-week Year ) ──────────────────────────────────────────────────────── 0-59 0-23 1-31 or ? 1-12 1-7 or ? 1970-2199 # Example: Every weekday at 9 AM UTC cron(0 9 ? * MON-FRI *)
The most critical rule: you cannot specify both Day-of-month and Day-of-week in the same expression. One of them must always be ?. AWS also uses a different day-of-week numbering: Sunday = 1, Monday = 2, ..., Saturday = 7.
| Feature | Linux Crontab | AWS EventBridge |
|---|---|---|
| Fields | 5 | 6 (+ Year) |
| Syntax wrapper | None | cron( ) |
| Sunday number | 0 or 7 | 1 |
| DOM + DOW together | OR logic (both allowed) | Not allowed — one must be ? |
| ? character | Not used | Required placeholder |
| Shorthand (@daily etc) | Supported | Not supported |
*) is a wildcard meaning "any value" for that field. So * in the hours field means "every hour", and * in the days field means "every day of the month". A cron expression with all asterisks (* * * * *) runs every single minute.0 0 * * * translates to "run at minute 0, hour 0 (midnight), every day of the month, every month, every day of the week." It is the standard way to schedule a daily midnight job.CronJob resources use the exact same 5-field crontab format as standard Linux. Inside your YAML file, under the spec block, you define the schedule key. For example, schedule: "0 0 * * *" will run the pod daily at midnight UTC.OnUnitActiveSec, Celery Beat, or an application-level scheduler).*/5 * * * * in a Linux crontab. For AWS EventBridge, use cron(*/5 * * * ? *). This runs at :00, :05, :10, :15, :20, :25, :30, :35, :40, :45, :50, :55 past every hour, every day.CronRead is a free cron expression generator that supports both Linux 5-field and AWS EventBridge 6-field syntax. Build visually, get human-readable previews, and validate before deploying.
Open CronRead — It's Free →Now that you understand cron syntax, explore these related guides:
→ 50+ Cron Job Examples (copy-paste ready) — real examples for every common scheduling pattern.
→ AWS EventBridge Cron Expression Guide — deep dive into the 6-field AWS format with 30 examples.