One-time jobs with at, and systemd timers

at: run something once, later

Sometimes you need a job to run once: restart a service at midnight after a change, or remove a temporary firewall rule in two hours. at does this. It needs the atd service running (systemctl enable --now atd).

$ at now + 2 hours
at> firewall-cmd --remove-port=9000/tcp
at> <Ctrl+D>
job 4 at Mon Oct 19 17:30:00 2026
$ echo "systemctl restart httpd" | at 23:00
$ at 02:00 tomorrow < /root/maintenance.sh
$ atq
4	Mon Oct 19 17:30:00 2026 a root
5	Mon Oct 19 23:00:00 2026 a root
$ at -c 5 | tail -2          # show what job 5 will run
$ atrm 5                     # cancel job 5

batch is a relative of at: it runs a job when the system load is low. Access to at is controlled by /etc/at.allow and /etc/at.deny, like cron.

systemd timers

A timer unit is a schedule for a service unit. Two small files: backup.service says WHAT to run, and backup.timer says WHEN. Compared with cron, timers log every run in the journal (journalctl -u backup), can run missed jobs after the machine was off (Persistent=true), can add a random delay so 500 servers do not all hit the backup server at once, and use all of systemd's controls (user, resource limits, dependencies).

# /etc/systemd/system/backup.service
[Unit]
Description=Nightly backup of /etc and /var/www

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh

# /etc/systemd/system/backup.timer
[Unit]
Description=Run backup.service every night at 01:30

[Timer]
OnCalendar=*-*-* 01:30:00
Persistent=true
RandomizedDelaySec=10min

[Install]
WantedBy=timers.target

# systemctl daemon-reload
# systemctl enable --now backup.timer      # enable the TIMER, not the service
Created symlink /etc/systemd/system/timers.target.wants/backup.timer → /etc/systemd/system/backup.timer.
# systemctl list-timers backup.timer
NEXT                        LEFT     LAST PASSED UNIT         ACTIVATES
Tue 2026-10-20 01:34:12 IST 10h left n/a  n/a    backup.timer backup.service
$ systemd-analyze calendar "Mon..Fri *-*-* 09:00:00"
  Original form: Mon..Fri *-*-* 09:00:00
Normalized form: Mon..Fri *-*-* 09:00:00
    Next elapse: Tue 2026-10-20 09:00:00 IST

Timers can also be relative: OnBootSec=5min runs 5 minutes after boot, OnUnitActiveSec=1h runs again 1 hour after the last run. RHEL itself uses timers, for example dnf-makecache.timer and fstrim.timer; systemctl list-timers --all shows them.

Common mistakes

• Enabling the .service instead of the .timer. The service then runs once at boot, not on schedule.
• Forgetting systemctl daemon-reload after creating the files.
• Using at without atd running: jobs are queued but never run.
• A typo in OnCalendar. Always test it with systemd-analyze calendar.