Linux · process & service management

crontab

run a command on a schedule

crontab manages your table of scheduled jobs. Each line is five time fields followed by a command, and the cron service runs the command whenever the clock matches — every night, every Monday, every five minutes.

The five fields, in order: minute, hour, day of month, month, day of week.

Edit

crontab -e

opens your table in an editor

List

crontab -l

prints it

Fields

m h dom mon dow

* means "every"

Runs as

You

with a minimal environment

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcron

$ crontab -l

1# m h dom mon dow command

20 2 * * * /home/user/backup.sh

3*/5 * * * * /usr/bin/curl -s https://example.com/ping > /dev/null

430 9 * * 1 /home/user/report.sh >> /home/user/report.log 2>&1

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The column order

A comment kept as a reminder: minute, hour, day of month, month, day of week, then the command.

Every day at 02:00

Minute 0, hour 2, and stars for the rest: any day, any month, any weekday.

Every five minutes

*/5 in the minute field means "every fifth minute". The output is thrown away so cron does not try to mail it.

Mondays at 09:30

Day of week 1 is Monday. Output and errors are appended to a log, which is how you find out why a job failed.

Switches

A switch changes how the command behaves. These are the ones used day to day; man crontab lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-e: Edit your crontab.
-l: List your crontab.
-r: Remove your whole crontab — without asking.
-u USER: Work on another user’s crontab. Needs root.
-i: With -r, ask for confirmation first.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

crontab -e

Edits your schedule. It is installed when you save and quit.

sudo crontab -l -u www-data

Lists another user’s jobs.

@reboot /home/user/start.sh

A crontab line that runs once each time the machine starts.

systemctl list-timers

Lists systemd timers — the modern alternative to cron.

In cybersecurity

A scheduled job is a command that runs with nobody watching.

A favourite place to persist

A line added to a crontab runs for ever. Reviewing every user’s crontab and /etc/cron.* is a standard step in checking a suspect machine.

Writable scripts run by root

If root’s crontab runs a script that another user can edit, that user can run anything as root. Check the permissions of every script cron calls.

Use full paths

Cron runs with a short PATH. A bare command name may not be found — or may find a different program from the one you meant.

Filed under

Process & service management

Read alongside

systemctlControls systemd services — start, stop, restart, enable at boot — and reports the state of each one.nohupRuns a command so that it keeps going after you log out or the terminal closes.