CRONTAB(5)

NAME
crontab - tables for driving cron

DESCRIPTION
A crontab file contains instructions to the cron(8) daemon of the general form: “ at these times on these dates run this command ”. There may be a system crontab (/etc/crontab) and each user may have their own crontab (/var/spool/cron/<user>). Commands in any given crontab will be executed either as the user who owns the crontab or, in the case of the system crontab, as the user specified in the command line. Uucp and News will usually each have their own crontab, eliminating the need for explicitly running su(1) as part of a cron(8) command.

While a crontab is a text file, it is not intended to be directly edited. Creation, modification, and removal of a crontab should be done using crontab(1).

Blank lines, leading spaces, and tabs are ignored. Lines whose first non-space character is a pound sign (‘#’) are comments, and are ignored. Note that comments are not allowed on the same line as cron(8) commands, since they will be taken to be part of the command. Similarly, comments are not allowed on the same line as environment variable settings.

An active line in a crontab is either an environment variable setting or a cron(8) command.

Environment Variable Settings

Environment variable settings create the environment any command in the crontab is run in. An environment variable setting is of the form:

    name = value

where the spaces around the equal-sign (‘=’) are optional, and any subsequent non-leading spaces in value will be part of the value assigned to name. The value string may be placed in quotes (single or double, but matching) to preserve leading or trailing blanks.

Several environment variables are set automatically by the cron(8) daemon. SHELL is set to /bin/sh, and LOGNAME and HOME are set from the /etc/passwd line of the crontab's owner. HOME and SHELL may be overridden by settings in the crontab; LOGNAME may not.

Note: on BSD systems the LOGNAME variable is sometimes called USER. On OpenBSD, cron(8) will set both USER and LOGNAME to the same value.

In addition to LOGNAME, HOME, and SHELL, cron(8) will look at MAILTO if it has any reason to send mail as a result of running commands in “this” crontab. If MAILTO is defined (and non-empty), mail is sent to the user so named. If MAILTO is defined but empty (MAILTO = ‘’), no mail will be sent. Otherwise mail is sent to the owner of the crontab. This option is useful for pseudo-users that lack an alias that would otherwise redirect the mail to a real person.

The MLS_LEVEL environment variable provides support for multiple per-job SELinux security contexts in the same crontab. By default, cron jobs execute with the default SELinux security context of the user that created the crontab file. When using multiple security levels and roles, this may not be sufficient, because the same user may be running in a different role or at a different security level. For more about roles and SELinux MLS/MCS see selinux(8) and undermentioned crontab example. You can set MLS_LEVEL to the SELinux security context string specifying the SELinux security context in which you want the job to run, and crond will set the execution context of the or jobs to which the setting applies to the specified context. See also the crontab(1) -s option.

cron Commands

The format of a cron(8) command is very much the V7 standard, with a number of upward-compatible extensions. Lines in the system crontab have six fixed fields plus a command in the form:

minute hour day-of-month month day-of-week user command

While lines in a user crontab have five fixed fields plus a command in the form:

minute hour day-of-month month day-of-week command

Fields are separated by blanks or tabs. The command may be one or more fields long. The allowed values for the fields are:

field
    allowed values
-----
    --------------
minute
    * or 0-59
hour
    * or 0-23
day-of-month
    * or 1-31
month
    * or 1-12 or a name (see below)
day-of-week
    * or 0-7 or a name (0 or 7 is Sunday)
user
    a valid username
command
    text

Lists are allowed. A list is a set of numbers (or ranges) separated by commas. Examples: “1,2,5,9”, “0-4,8-12”.

Ranges of numbers are allowed. Ranges are two numbers separated with a hyphen. The specified range is inclusive. For example, 8-11 for an hour entry specifies execution at hours 8, 9, 10 and 11.

Step values can be used in conjunction with ranges. Following a range with /number specifies skips of number through the range. For example, “0-23/2” can be used in the hour field to specify command execution every other hour (the alternative in the V7 standard is “0,2,4,6,8,10,12,14,16,18,20,22”). Steps are also permitted after an asterisk, so if you want to say “every two hours”, just use “*/2”.

An asterisk (‘*’) is short form for a range of all allowed values.

Names can be used in the month and day-of-week fields. Use the first three letters of the particular day or month (case doesn't matter). Ranges or lists of names are not allowed.

The command field (the rest of the line) is the command to be run. The entire command portion of the line, up to a newline or % character, will be executed by /bin/sh or by the shell specified in the SHELL variable of the crontab. Percent signs (‘%’) in the command, unless escaped with a backslash (‘\’), will be changed into newline characters, and all data after the first ‘%’ will be sent to the command as standard input.

Commands are executed by cron(8) when the minute, hour, and month fields match the current time, and when at least one of the two day fields (day-of-month or day-of-week, see Note below) match the current time. cron(8) examines crontab entries once every minute.

Note: The day of a command's execution can be specified by two fields — day-of-month and day-of-week. If both fields are restricted (i.e., aren't *), the command will be run when either field matches the current time. For example,

    30 4 1,15 * 5

would cause a command to be run at 4:30 am on the 1st and 15th of each month, plus every Friday.

Instead of the first five fields, one of eight special strings may appear:

string
    meaning
------
    -------
@reboot
    Run once, at cron(8) startup.
@yearly
    Run every January 1, "0 0 1 1 *".
@annually
    (same as @yearly).
@monthly
    Run the first day of every month, "0 0 1 * *".
@weekly
    Run every Sunday, "0 0 * * 0".
@daily
    Run every midnight, "0 0 * * *".
@midnight
    (same as @daily).
@hourly
    Run every hour, on the hour, "0 * * * *".

EXAMPLES

    # use /bin/sh to run commands, no matter what /etc/passwd says
    SHELL=/bin/sh
    # mail any output to `paul', no matter whose crontab this is
    MAILTO=paul
    #
    # run five minutes after midnight, every day
    5 0 * * *       $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
    # run at 2:15pm on the first of every month -- output mailed to paul
    15 14 1 * *     $HOME/bin/monthly
    # run at 10 pm on weekdays, annoy Joe
    0 22 * * 1-5	mail -s "It's 10pm" joe%Joe,%%Where are your kids?%
    23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"
    5 4 * * sun     echo "run at 5 after 4 every sunday"

SELinux with multi level security (MLS)
In crontab is important specified security level by crontab -s or specifying the required level on the first line of the crontab. Each level is specified in /etc/selinux/targeted/seusers. For using crontab in MLS mode is really important:
- check/change actual role,
- set correct role for directory, which is used for input/output.

EXAMPLE FOR SELINUX MLS
# login as root
newrole -r sysadm_r
mkdir /tmp/SystemHigh
chcon -l SystemHigh /tmp/SystemHigh
crontab -e
# write in crontab file
MLS_LEVEL=SystemHigh
0-59 * * * * id -Z > /tmp/SystemHigh/crontest
When I log in as a normal user, it can't work, because /tmp/SystemHigh is
higher than my level.

SEE ALSO
crontab(1), cron(8)

EXTENSIONS
When specifying day-of-week, both day 0 and day 7 will be considered Sunday. BSD and ATT seem to disagree about this.

Lists and ranges are allowed to coexist in the same field. “1-3,7-9” would be rejected by ATT or BSD cron — they want to see “1-3” or “7,8,9” only.

Ranges can include “steps”, so “1-9/2” is the same as “1,3,5,7,9”.

Months or days of the week can be specified by name.

Environment variables can be set in the crontab. In BSD or ATT, the environment handed to child processes is basically the one from /etc/rc.

Command output is mailed to the crontab owner (BSD can't do this), can be mailed to a person other than the crontab owner (SysV can't do this), or the feature can be turned off and no mail will be sent at all (SysV can't do this either).

All of the ‘@’ commands that can appear in place of the first five fields are extensions.

AUTHORS
Paul Vixie <vixie@isc.org>