How Cron Daemon Schedules Tasks in Linux

This article provides an overview of how the cron daemon automates tasks in Linux, explaining the background process, crontab syntax, and the step-by-step execution cycle used to run scheduled commands reliably.

The Cron Daemon Architecture

The cron daemon, commonly named crond or cron, is a background utility that initializes during the Linux boot sequence and runs continuously as a system service. Its sole purpose is to execute unattended maintenance jobs, system scripts, and user commands at specified intervals. Rather than consuming CPU cycles with real-time tracking, the daemon relies on an event loop tied to the system clock.

The Crontab Configuration

Tasks are defined in configuration tables known as "crontabs." Linux categorizes these into two primary types:

  1. User Crontabs: Stored in spool directories (typically /var/spool/cron/ or /var/spool/cron/crontabs/), managed by individual users via the crontab -e command without requiring direct root access.
  2. System Crontabs: Located in /etc/crontab and the /etc/cron.d/ directory, these files contain an extra field specifying the user account that should execute the command. Additionally, directories like /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly, and /etc/cron.monthly handle pre-packaged scripts run by tools like anacron or standard cron jobs.

Each entry in a standard user crontab follows a five-field time-and-date format followed by the command:

* * * * * command_to_execute
- - - - -
| | | | |
| | | | +-- Day of the week (0 - 7, where Sunday is 0 or 7)
| | | +---- Month (1 - 12)
| | +------ Day of the month (1 - 31)
| +-------- Hour (0 - 23)
+---------- Minute (0 - 59)

Operators such as asterisks (wildcard), commas (value lists), hyphens (ranges), and slashes (step values) allow for granular frequency definitions.

The Execution Cycle

The cron daemon operates on a 60-second polling cycle:

  1. Sleep and Wake: The daemon sleeps until the top of the minute, synchronized with system time.
  2. Directory and Modtime Checks: Upon waking, it inspects /etc/crontab, /etc/cron.d/, and the user spool directories to detect any file modifications since the last check. If a file has been modified, it reloads the table into memory without requiring a service restart.
  3. Time Matching: The daemon checks the current system minute, hour, day, month, and day-of-week against the loaded entries.
  4. Process Forking: When a crontab entry matches the current time, the daemon forks a child process to execute the specified command. It changes the user and group ID of the process to match the crontab owner.
  5. Output Handling: The command runs in a subshell (typically /bin/sh). Standard output (stdout) and standard error (stderr) are captured and, by default, sent via local mail to the crontab owner unless explicitly redirected to a file or /dev/null.

Execution Environment and Security

Cron jobs execute in a restricted, non-interactive environment. Environment variables common to interactive shells, such as extended $PATH definitions, aliases, and custom variables, are not loaded by default. Commands must either use absolute paths or define required environment variables at the top of the crontab file.

Access to the scheduling system is managed through /etc/cron.allow and /etc/cron.deny. If cron.allow exists, only users listed within it can create schedules. If only cron.deny exists, any user not listed in the file is permitted to use the service.