Linux Job Scheduling: cron, crontab, at and systemd Timers Explained

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: the milkman and the alarm

Why do we need this?

The milkman comes every day at 6 a.m. without being asked. That is a repeating schedule. Your phone alarm for the 4:30 p.m. dentist visit rings only once. And a good alarm app shows a 'missed alarm' if the phone was off, so you still know.

What is it?

Milkman = cron. One-time alarm = at. Alarm app with missed-alarm = systemd timer with Persistent=true.

How to do it (step by step)

2. The five time fields

Why do we need this?

Every cron mistake starts with a wrong field. Learn them once and you can read any schedule.

What is it?

minute (0-59), hour (0-23), day of month (1-31), month (1-12), day of week (0-7, 0 and 7 are Sunday). * = every. , = list (1,15). - = range (1-5). / = step (*/10). Then the command.

How to do it (step by step)

1. A nightly backup at 2 a.m.

0 2 * * * /usr/local/bin/backup.sh

Output:

(a crontab line)

What it means: Minute 0, hour 2, every day.

2. Office hours report.

30 9 * * 1-5 /usr/local/bin/report.sh

Output:

(a crontab line)

What it means: Weekdays only.

3. Check a schedule before you trust it.

systemd-analyze calendar 'Mon..Fri 09:30'

Output:

  Original form: Mon..Fri 09:30
Normalized form: Mon..Fri *-*-* 09:30:00
    Next elapse: Mon 2026-10-26 09:30:00 IST

What it means: Shows the next run time.

3. crontab -e and -l: edit and list your jobs

Why do we need this?

Each user has a personal crontab. Editing it through crontab checks syntax and tells crond.

What is it?

crontab -e opens your crontab in $EDITOR. Save to install. crontab -l prints it. Never edit /var/spool/cron files by hand. Lines starting with # are comments.

How to do it (step by step)

1. Open the editor.

EDITOR=nano crontab -e

Output:

crontab: installing new crontab

What it means: Printed after you save.

2. List your jobs.

crontab -l

Output:

# nightly backup
0 2 * * * /usr/local/bin/backup.sh

What it means: What cron will run for you.

3. No crontab yet.

crontab -l

Output:

no crontab for ec2-user

What it means: Normal for a new user.

4. crontab FILE, -r and -u

Why do we need this?

Automation tools install crontabs from files. Admins sometimes manage another user's jobs.

What is it?

crontab FILE replaces your whole crontab with the file. crontab -r deletes all your jobs with no question (-i asks first). sudo crontab -u USER -l or -e works on another user. Back up first: crontab -l > ~/cron.bak.

How to do it (step by step)

1. Back up your jobs.

crontab -l > ~/cron.bak && wc -l ~/cron.bak

Output:

2 /home/ec2-user/cron.bak

What it means: Do this before any change.

2. Install from a file.

crontab ~/cron.bak

Output:

(no output)

What it means: Replaces everything.

3. See the app user's jobs.

sudo crontab -u shop -l

Output:

*/10 * * * * /opt/shop/bin/sync

What it means: Read-only look.

4. Delete with a question.

crontab -ri

Output:

crontab: really delete ec2-user's crontab? (y/n)

What it means: -r alone does not ask. Careful.

5. Special strings: @reboot, @daily and more

Why do we need this?

Some schedules are easier to read as words. @reboot is the only way in cron to run once at boot.

What is it?

@reboot (at crond start), @hourly (0 * * * *), @daily or @midnight (0 0 * * *), @weekly (0 0 * * 0), @monthly (0 0 1 * *), @yearly (0 0 1 1 *).

How to do it (step by step)

1. Warm a cache after boot.

@reboot sleep 30 && /opt/shop/bin/warm-cache

Output:

(a crontab line)

What it means: sleep gives the network time.

2. Weekly cleanup.

@weekly find /tmp/shop -mtime +7 -delete

Output:

(a crontab line)

What it means: Sunday midnight.

6. /etc/crontab, /etc/cron.d and cron.daily

Why do we need this?

System and package jobs live in files, not in a user's crontab, so they can be shipped and reviewed in Git.

What is it?

Files in /etc/cron.d and /etc/crontab have a sixth field: the user. Scripts in /etc/cron.hourly, daily, weekly, monthly run by run-parts (or anacron); they must be executable and have no dot in the name on Debian.

How to do it (step by step)

1. A system job with a user field.

echo '*/15 * * * * shop /opt/shop/bin/sync >> /var/log/shop/sync.log 2>&1' | sudo tee /etc/cron.d/shop-sync

Output:

*/15 * * * * shop /opt/shop/bin/sync >> /var/log/shop/sync.log 2>&1

What it means: Runs as user shop.

2. A daily script.

sudo install -m 755 cleanup.sh /etc/cron.daily/cleanup

Output:

(no output)

What it means: No .sh extension, mode 755.

3. Which daily scripts will run?

run-parts --test /etc/cron.daily

Output:

/etc/cron.daily/cleanup
/etc/cron.daily/logrotate

What it means: Lists what would run.

7. The cron environment: PATH, SHELL and MAILTO

Why do we need this?

'It works in my terminal but not in cron' is the most common cron problem. cron gives you a tiny environment.

What is it?

cron uses /bin/sh, PATH=/usr/bin:/bin, HOME of the user, no .bashrc. Fix: use full paths, or set PATH= and SHELL= at the top of the crontab. MAILTO=you@x sends output by mail; MAILTO="" turns mail off. % is special in cron: escape as \%.

How to do it (step by step)

1. See cron's environment.

* * * * * env > /tmp/cron-env.txt

Output:

(after one minute) PATH=/usr/bin:/bin
SHELL=/bin/sh
HOME=/home/ec2-user

What it means: Very small PATH.

2. Set it at the top.

SHELL=/bin/bash
PATH=/usr/local/bin:/usr/bin:/bin
MAILTO=""

Output:

(crontab header lines)

What it means: Now jobs find aws, node and others.

3. Escape % in a date.

0 1 * * * tar czf /backup/site-$(date +\%F).tgz /var/www

Output:

(a crontab line)

What it means: Without \ the line is cut at %.

8. Logging cron output and checking runs

Why do we need this?

A silent failing job is worse than no job. You need proof it ran and what it printed.

What is it?

Redirect: >> /var/log/job.log 2>&1 keeps output and errors. cron runs are logged in /var/log/cron (RHEL) or the journal (journalctl -u cron or -u crond). Or pipe to logger -t job.

How to do it (step by step)

1. Keep output.

0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

Output:

(a crontab line)

What it means: 2>&1 also catches errors.

2. Did it run?

journalctl -u crond --since today --no-pager | grep backup

Output:

Oct 25 02:00:01 web1 CROND[3301]: (root) CMD (/usr/local/bin/backup.sh >> /var/log/backup.log 2>&1)

What it means: It started at 02:00:01.

3. Send output to the journal.

*/5 * * * * /opt/shop/bin/sync 2>&1 | logger -t shop-sync

Output:

(a crontab line)

What it means: Read with journalctl -t shop-sync.

9. flock: stop jobs from overlapping

Why do we need this?

If a 5-minute job sometimes takes 7 minutes, two copies run together and can corrupt data.

What is it?

flock -n /tmp/NAME.lock COMMAND runs only if it gets the lock; -n means give up at once if busy. The lock is freed when the command ends.

How to do it (step by step)

1. Safe 5-minute sync.

*/5 * * * * flock -n /tmp/sync.lock /opt/shop/bin/sync

Output:

(a crontab line)

What it means: A second copy just exits.

2. Test by hand.

flock -n /tmp/demo.lock sleep 60 & sleep 1; flock -n /tmp/demo.lock echo second; echo exit=$?

Output:

exit=1

What it means: Second run was refused.

10. at: run a job once later

Why do we need this?

Some tasks happen once: restart at 11 p.m. tonight, remove a temporary firewall rule in 2 hours.

What is it?

Install the at package and start atd. at TIME reads commands from stdin; finish with Ctrl+D. TIME like 23:00, now + 2 hours, 'tomorrow 09:00', noon. -f FILE reads from a file. batch runs when load is low.

How to do it (step by step)

1. Start atd.

sudo systemctl enable --now atd

Output:

(no output)

What it means: Without atd nothing runs.

2. Restart tonight at 11.

echo 'systemctl restart shop-api' | sudo at 23:00

Output:

job 4 at Sun Oct 25 23:00:00 2026

What it means: Job number 4.

3. Undo a rule in 2 hours.

echo 'firewall-cmd --remove-port=8080/tcp' | sudo at now + 2 hours

Output:

job 5 at Sun Oct 25 14:45:00 2026

What it means: A safety net.

11. atq, at -c and atrm

Why do we need this?

You must be able to see and cancel pending one-time jobs.

What is it?

atq lists pending jobs (sudo atq for all). at -c N prints what job N will run. atrm N deletes it.

How to do it (step by step)

1. List.

sudo atq

Output:

4	Sun Oct 25 23:00:00 2026 a root
5	Sun Oct 25 14:45:00 2026 a root

What it means: Number, time, queue, user.

2. Look inside.

sudo at -c 4 | tail -n 2

Output:

systemctl restart shop-api

What it means: The last lines are your commands.

3. Cancel.

sudo atrm 4 && sudo atq

Output:

5	Sun Oct 25 14:45:00 2026 a root

What it means: Job 4 gone.

12. systemd timers: OnCalendar and Persistent

Why do we need this?

Timers give you journal logs, resource limits, no overlap and catch-up after downtime, for free.

What is it?

You need two files: NAME.service (what to run, Type=oneshot) and NAME.timer (when). OnCalendar=*-*-* 02:00:00 or daily, Mon..Fri 09:30. OnBootSec=5min and OnUnitActiveSec=1h for intervals. Persistent=true runs a missed job at boot. RandomizedDelaySec spreads load. Enable the timer, not the service.

How to do it (step by step)

1. The service.

sudo tee /etc/systemd/system/backup.service <<'X'
[Unit]
Description=Nightly backup
[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh
X

Output:

(file text)

What it means: No [Install] needed.

2. The timer.

sudo tee /etc/systemd/system/backup.timer <<'X'
[Unit]
Description=Run backup daily at 2
[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
RandomizedDelaySec=10min
[Install]
WantedBy=timers.target
X

Output:

(file text)

What it means: Same base name as the service.

3. Enable the timer.

sudo systemctl daemon-reload && sudo systemctl enable --now backup.timer

Output:

Created symlink /etc/systemd/system/timers.target.wants/backup.timer → /etc/systemd/system/backup.timer.

What it means: Now it is scheduled.

4. Run it now once to test.

sudo systemctl start backup.service && journalctl -u backup -n 3 --no-pager

Output:

Oct 25 12:50:01 web1 systemd[1]: Finished Nightly backup.

What it means: Logs come free.

13. systemctl list-timers

Why do we need this?

You need one view of every timer: when it last ran and when it runs next.

What is it?

systemctl list-timers shows active timers with NEXT, LEFT, LAST, PASSED, UNIT, ACTIVATES. --all includes inactive ones.

How to do it (step by step)

1. All timers.

systemctl list-timers --no-pager | head -3

Output:

NEXT                        LEFT     LAST                        PASSED  UNIT              ACTIVATES
Mon 2026-10-26 02:04:11 IST 13h left Sun 2026-10-25 12:50:01 IST 3s ago backup.timer      backup.service
Mon 2026-10-26 00:00:00 IST 11h left Sun 2026-10-25 00:00:00 IST 12h ago logrotate.timer   logrotate.service

What it means: The random delay shows as 02:04.

2. Test an expression.

systemd-analyze calendar --iterations=3 'Mon *-*-* 08:00'

Output:

Next elapse: Mon 2026-10-26 08:00:00 IST
       Iter. #2: Mon 2026-11-02 08:00:00 IST
       Iter. #3: Mon 2026-11-09 08:00:00 IST

What it means: Three next runs.

14. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

15. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

16. Troubleshooting step by step

Why do we need this?

If a scheduled job did not do its work, prove each link: schedule, start, environment, output.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Is the job installed?

crontab -l; ls /etc/cron.d

2. Is cron running?

systemctl is-active crond

3. Did cron start it?

journalctl -u crond --since today --no-pager | tail

4. Run it with cron's environment.

env -i SHELL=/bin/sh PATH=/usr/bin:/bin HOME=$HOME /bin/sh -c '/usr/local/bin/backup.sh'

5. Read its own output log.

tail -n 30 /var/log/backup.log

6. For timers, check next run and logs.

systemctl list-timers --all; journalctl -u backup -n 20

17. Lab 1: A safe cron job with logs and a lock

Why do we need this?

Write a job that runs every minute, logs output, cannot overlap, then remove it.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Back up crontab.

crontab -l > ~/cron.bak 2>/dev/null; echo saved

Output:

saved

2. Add the job.

(crontab -l 2>/dev/null; echo '* * * * * flock -n /tmp/tick.lock /bin/date >> /tmp/tick.log 2>&1') | crontab -

Output:

(no output)

3. Confirm.

crontab -l | tail -n1

Output:

* * * * * flock -n /tmp/tick.lock /bin/date >> /tmp/tick.log 2>&1

4. Wait 2 minutes and read.

sleep 125; cat /tmp/tick.log

Output:

Sun Oct 25 13:01:01 IST 2026
Sun Oct 25 13:02:01 IST 2026

5. Restore.

crontab ~/cron.bak 2>/dev/null || crontab -r; crontab -l

Output:

(your old jobs)

18. Lab 2: Replace a cron job with a systemd timer, plus at

Why do we need this?

Build a timer that runs every 2 minutes, view it, then schedule a one-time at job and cancel it.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Service.

printf '[Service]\nType=oneshot\nExecStart=/usr/bin/logger -t tick hello\n' | sudo tee /etc/systemd/system/tick.service

Output:

[Service]

2. Timer.

printf '[Timer]\nOnBootSec=1min\nOnUnitActiveSec=2min\n[Install]\nWantedBy=timers.target\n' | sudo tee /etc/systemd/system/tick.timer && sudo systemctl daemon-reload && sudo systemctl enable --now tick.timer

Output:

Created symlink ... tick.timer

3. See it.

systemctl list-timers tick.timer --no-pager

Output:

NEXT ... tick.timer tick.service

4. at job then cancel.

echo 'logger -t atlab hi' | at now + 30 minutes; atq; atrm $(atq | awk '{print $1}' | tail -n1); atq

Output:

job 7 at Sun Oct 25 13:35:00 2026

5. Clean up.

sudo systemctl disable --now tick.timer && sudo rm /etc/systemd/system/tick.* && sudo systemctl daemon-reload

Output:

Removed ... tick.timer

19. Frequently asked questions

20. Interview questions and answers

Beginner level

Mid level level

Senior level

21. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.