What the five fields mean
From the left: minute, hour, day of month, month, day of week. So 0 9 * * 1 means minute 0, hour 9, no restriction on the date or the month, and Monday — every Monday at nine in the morning.
An asterisk means the field is unrestricted. Leaving an early field open makes the job run far more often than intended: * * * * * fires every minute. An asterisk left in the minute field by accident runs the job 1,440 times a day.
Reading the symbols
1-5is a run of values from 1 through 5.1,3,5is those three values only.*/15steps by fifteen from zero. In the minute field that gives 0, 15, 30 and 45.9-17/2steps only within the range.- Days and months accept names:
MON-FRI,JAN,JUL.
In the weekday field 0 is Sunday and 6 is Saturday. Most implementations also accept 7 for Sunday, so 0 and 7 point at the same day.
Using day of month and day of week together
This is the field pair that catches people out. When the third field and the fifth field are both restricted, cron runs on any day matching either one — not on days matching both.
0 0 1 * MON is not “the first of the month when it falls on a Monday”. It is the first of the month or every Monday, which fires about five times a month. Restrict one field and leave the other as an asterisk to avoid this.
Check the time zone first
The times shown here follow the time zone of the device you are reading this on. The cron daemon on a server follows the server’s zone, so confirm what that is before you deploy. Servers set to UTC are common, and a job aimed at nine in the morning locally can end up running in the middle of the afternoon.
Where daylight saving applies, a job scheduled during the shifted hour may be skipped or run twice on changeover days. Avoiding the 2 a.m. hour sidesteps the problem.
Six fields is a different dialect
Some expressions carry a leading seconds field, making six in total. That is the Spring and Quartz convention and it is not what standard crontab reads. This tool reads five fields only.
Pasting a six-field expression into a crontab shifts everything by one position: the seconds value is read as minutes and the minutes as hours. Settle which syntax the target uses before copying anything across.