Reading the five fields
A standard cron expression has five fields in a fixed order: minute, hour, day of month, month, and day of week. An asterisk means every value. A slash defines a step, so */15 in the minute field means every fifteen minutes. A comma lists specific values and a hyphen gives a range.
The order is the part people misremember, and the mistake is expensive because a wrong expression rarely errors - it just runs at some other time, quietly, until someone notices the report arrived at four in the morning.
The day-of-month and day-of-week trap
When both the day-of-month and day-of-week fields are restricted, most cron implementations treat them as OR rather than AND. An expression restricted to the 1st and to Monday runs on the 1st of the month and on every Monday, not only on a Monday that falls on the 1st.
This surprises nearly everyone the first time. If you need the AND behaviour, the usual approach is to schedule the broader pattern and check the other condition inside the job itself.
Timezones, overlap and the thundering herd
Cron runs in the timezone of whatever is executing it. On a server set to UTC that is straightforward; on anything set to a local zone, daylight-saving transitions mean a job can run twice or not at all on two days a year. Scheduling in UTC avoids the whole problem.
Also worth avoiding: scheduling everything on the hour. If every job in your infrastructure fires at zero minutes past, they contend for the same resources and the same downstream APIs at the same instant. Offsetting jobs by a few minutes costs nothing and spreads the load.
Frequently asked questions
- What order are the cron fields in?
- Minute, hour, day of month, month, day of week. Some systems add a sixth leading field for seconds, but the classic five-field form does not include one.
- What does */5 mean?
- A step value: every fifth unit of that field starting from zero. In the minute field it means every five minutes.
- Why does my job run more often than expected?
- Most likely you restricted both day-of-month and day-of-week. Cron combines those two fields with OR, so the job runs on either condition rather than only when both hold.
- What timezone does cron use?
- The timezone of the system running it. Servers set to a local timezone can run a job twice or skip it during daylight-saving changes, so scheduling in UTC is safer.