The cron rule that makes your job run 5x more often than you think

The day-of-month / day-of-week OR rule, explained with a real expression.

The five fields

Standard cron expressions have five fields: minute, hour, day of month, month, and day of week.

0 0 1 * 1

Why it runs more often

This expression means midnight on the first day of the month, or midnight every Monday. When both day-of-month and day-of-week are restricted, standard cron uses OR, not AND. In a month where the 1st is a Wednesday, it runs on the 1st and every Monday after it.

The first Monday

Standard cron cannot cleanly express “the first Monday of the month.” Put a day-of-week check inside the job, or use a scheduler with Quartz-style extensions.

AdroitPad's Cron Explainer shows the next six fire times and calls out this OR rule before you ship the schedule.

Conclusion

The important detail is that the two calendar fields are not a combined filter in standard cron. The diagram makes the OR relationship explicit: either the day-of-month branch or the day-of-week branch can reach the job. That is why a schedule that looks like “the first Monday” can fire several times in a month. Validate the next fire times before enabling production work. Add idempotency when duplicate execution would be expensive or destructive. If the requirement is truly one occurrence, put the final date check inside the job or use a scheduler with a first-weekday primitive.