Behind a single crontab line hides an architecture: the crond daemon that reads schedule files, checks time fields every minute, then runs commands through a shell. This episode maps out crond, the crontab command, /etc/crontab, /etc/cron.d/, the cron.hourly/daily/weekly/monthly directories, and the role of anacron.

In episode 1 we understood the history and the reasons cron exists. Now we dissect its mechanics: how a single small daemon named crond can trigger dozens of commands on time every day, without ever forgetting and without human intervention.
Understanding this architecture matters before writing crontab, because many classic errors — jobs that don't run, jobs that run twice, or jobs that run at unexpected times — have their roots in how crond reads and interprets schedule files. Let's pop the hood.
crond is a daemon — a process that runs in the background at all times. Every minute, it wakes up, reads all schedule files (crontabs), compares the current time with the time fields on each line, then runs the commands that match.
systemctl status crond
pgrep -x crondIts workflow:
crond reads per-user crontabs and system files.minute hour day month weekday fields.Each crontab line has 5 time fields in front of the command:
minute hour day-of-month month day-of-week command* (all values), lists, ranges, or steps.We'll break down the full syntax and all special characters in detail in episode 3.
Cron's architecture consists of several files and directories that complement each other:
Two different binaries:
crond — the daemon that executes schedules.crontab — the program that manages per-user schedule files (episode 4).which crond
which crontabThe system-level schedule file. The difference from a per-user crontab: schedule lines here have a user field that determines who runs the command.
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
25 6 * * * root test -x /usr/sbin/anacron && /usr/sbin/anacronA directory containing additional schedule files in the same format as /etc/crontab (including the user field). It's used by packages like logrotate to register their own schedules without touching /etc/crontab.
Special directories that run every script inside them at a given interval, via run-parts. Just drop an executable script into /etc/cron.daily/ and it automatically runs every day. We'll cover the details in episode 8.
ls -l /etc/cron.daily/As in episode 1, anacron catches up on missed jobs. In cronie, it runs from /etc/cron.daily/ and reads the /etc/anacrontab configuration. If the machine was asleep at the scheduled time, the job runs as soon as the machine is active again.
For clarity, here's the full flow as a minute rolls over:
crond wakes up and scans all crontabs (per-user in /var/spool/cron/, /etc/crontab, /etc/cron.d/).SHELL.cron.daily and friends directories are run via run-parts on their schedule.MAILTO or discarded.Note
crond does not remember jobs that were missed while the machine was off. That's anacron's job — which is why the two are always paired. Cron is precise to the minute; anacron is precise to "a few days have passed". Know this division of labor so you don't put a job in the wrong place.
| Component | Level | User field? | Used for |
|---|---|---|---|
per-user crontab (/var/spool/cron/) | User | No | Personal schedules |
/etc/crontab | System | Yes | Global schedules |
/etc/cron.d/ | System | Yes | Package/optional schedules |
cron.daily etc. | System | No (root) | Daily interval scripts |
| anacron | System | Yes | Missed jobs |
Key takeaways:
crond is the daemon that wakes up every minute and matches time fields.minute hour day-of-month month day-of-week + command./etc/crontab and /etc/cron.d/.cron.hourly|daily|weekly|monthly directories run via run-parts.In episode 3 we'll fully dissect crontab syntax and time fields — the *, ,, -, and / characters, month and day names, plus the OR/AND rules that frequently trap beginners. After this episode, you'll be able to read and write any cron schedule with confidence!