A cron expression is a string of 5 space-separated fields that define a recurring schedule for automated tasks. Each field represents a time unit: minute (0–59), hour (0–23), day of month (1–31), month (1–12), and day of week (0–6, where 0 is Sunday). The cron daemon (or scheduler) reads this expression and executes the associated command every time the current date/time matches the pattern. For example, '0 9 * * 1-5' means 'at 9:00 AM, Monday through Friday'.

The five fields in order are: (1) Minute — 0 to 59, (2) Hour — 0 to 23 using 24-hour time, (3) Day of Month — 1 to 31, (4) Month — 1 to 12 (or JAN to DEC), (5) Day of Week — 0 to 6 where 0 and 7 both represent Sunday (or SUN to SAT). Use * to mean 'any value' in a field. Example: '30 6 * * 1' means 'at 6:30 AM every Monday'. A common mnemonic is: Minute Hour Day Month Weekday.

Use the step operator /. The expression '*/5 * * * *' means 'every 5 minutes'. The */ syntax means 'starting from 0, every N units'. So */5 for minutes gives: 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55. You can also use '*/10' for every 10 minutes, '*/15' for every 15 minutes, or '*/30' for every 30 minutes. To run every 5 minutes only during business hours on weekdays: '*/5 9-17 * * 1-5'.

The * (asterisk) is the standard wildcard meaning 'any value' and is supported by all cron implementations. The ? (question mark) means 'no specific value' and is used in Quartz Scheduler (Spring), AWS EventBridge, and some other platforms. In these platforms, when you specify a day-of-week value, you must use ? for the day-of-month field (and vice versa) to avoid ambiguity. Standard Unix/Linux crontab does not support ? — use * instead.

In standard Unix cron, there is no direct way to schedule on the last day of every month because months have different lengths. A common workaround is to use a script that checks if tomorrow is the 1st: '0 23 28-31 * * [ "$(date -d tomorrow +\%d)" = "01" ] && /your/script'. In Quartz Scheduler (Spring/Java) and some extended cron implementations, you can use 'L' in the day-of-month field: '0 0 23 L * ?' means 'at 11:00 PM on the last day of every month'.

Unix cron traditionally numbers days of the week starting from Sunday as 0, ending with Saturday as 6. This follows the POSIX standard and C's struct tm.tm_wday convention. In practice, both 0 and 7 work for Sunday in most cron implementations. However, Quartz Scheduler (used in Spring/Java) uses a different numbering: SUN=1, MON=2, ..., SAT=7. AWS EventBridge also uses 1-based DOW. Always verify the numbering for your specific platform to avoid off-by-one bugs.

Cron is the background daemon (service) that reads schedules and executes commands at the right time. It runs continuously in the background on Unix-like systems. Crontab (cron table) is the configuration file that lists the schedules — each line is one job. Every user on a system can have their own crontab file, edited with 'crontab -e'. The system also has a global crontab at /etc/cron.d/. The term 'cron expression' refers to the time-specification part of a crontab line.

Use the day-of-week field with a range. '1-5' means Monday through Friday (1=Mon, 5=Fri). For example, '0 9 * * 1-5' runs at 9:00 AM Monday through Friday. You can also use names: '0 9 * * MON-FRI'. Note: if you also specify a day-of-month value (not *), cron uses OR logic — the job runs when either the DOM or DOW matches. To avoid this, keep the DOM field as * when restricting by day of week.

Standard Unix/Linux cron runs in the system's local timezone, which is set by the TZ environment variable or the system's /etc/localtime. Many cloud platforms like AWS EventBridge and GitHub Actions run cron in UTC by default — always check the platform docs. To avoid timezone confusion in production systems, it is best practice to write cron expressions in UTC and document this clearly. Tools like GCP Cloud Scheduler let you specify a timezone per job, which is more intuitive for business-hour schedules.

AWS EventBridge cron has several key differences: (1) It is wrapped in cron(): 'cron(0 9 ? * MON-FRI *)'. (2) A 6th field for year is added at the end (usually *). (3) Day of week is 1-based: SUN=1, MON=2, ..., SAT=7 (unlike Unix 0-based). (4) Either DOM or DOW must be ? — you cannot restrict both simultaneously. (5) You cannot use */1 for every minute; the minimum interval is 1 minute using '* * * * ? *'. EventBridge also supports rate expressions like 'rate(5 minutes)' as an alternative to cron.

Quartz cron expressions have 6 required fields (and an optional 7th for year): SECOND MINUTE HOUR DAY-OF-MONTH MONTH DAY-OF-WEEK [YEAR]. Key differences from Unix: (1) A seconds field is added as the first field (usually 0). (2) DOW uses 1-based numbering: SUN=1, MON=2, ..., SAT=7. (3) Either DOM or DOW must be ?, not both specified. (4) Supports additional special characters: L (last), W (nearest weekday), # (nth weekday). Example: '0 0 9 ? * MON-FRI' is equivalent to Unix '0 9 * * 1-5'.

The best way is to use an online cron expression checker like this tool, which shows the next 10 exact run times — so you can verify the schedule matches your intent before deploying. For production systems, also consider: (1) Run the job manually once to verify the command works. (2) Test with a short interval (e.g., every minute) and monitor for a few runs, then change to the production schedule. (3) Check timezone settings explicitly — many production bugs come from UTC vs local time mismatch. (4) Use cron job monitoring tools (Dead Man's Snitch, Cronitor, Healthchecks.io) to detect missed or failed runs.