Cron executes scheduled jobs: per-user crontabs plus system-wide directories (/etc/cron.d and friends). The five-field syntax (minute hour day month weekday) covers everything from “every minute” to “first Sunday of the month”.
On shared servers cron is both vital and unruly: dozens of accounts each schedule their own jobs, heavy ones collide at popular minutes causing recurring load spikes, and post-compromise persistence loves hiding in crontabs. Auditing all of it from one place is a recurring administrative win.
Frequently asked questions
Why does my server spike at the same minute every day?
Because that is when a scheduled job (or several overlapping ones) runs. Match the spike’s timestamp against all crontabs and stagger the heavy jobs.
Where are all the cron jobs defined?
Per-user crontabs (crontab -l per account, stored under /var/spool/cron/) plus system locations like /etc/cron.d/ and /etc/cron.daily/.