Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 49

Managing System Services with systemctl

Recommended resources

Hello! Welcome to the next lesson in our module on Process, Service, and Task Management.

In our previous lesson, we learned how to manage jobs within a single shell session using commands like bg, fg, and nohup. Those tools are perfect for tasks you start and manage yourself. Today, we shift our focus from temporary, user-initiated jobs to the persistent, system-level processes that form the foundation of a running Linux system: services.

This lesson addresses the learning outcome: Inspect service status and logs using systemctl. We'll explore systemd, the modern system and service manager, and learn how to use its primary tool, systemctl, to check on the health of these crucial background processes. We will also dive into journalctl to perform detailed log analysis, an essential skill for troubleshooting.

1. From Jobs to Services: What is systemd?

In the last lesson, we saw that a job is a process or group of processes started by your shell. When you log out, the shell and its jobs typically terminate. A service (also called a daemon) is different. It's a program designed to run continuously in the background, independent of any user session, to provide core functionality. Examples include your SSH server (sshd), web server (httpd or nginx), or printing service (cupsd).

On modern Linux distributions, these services are managed by an init system. The init system is the very first process that the kernel starts (it always has Process ID 1), and its job is to start and manage all other processes on the system. The most common init system today is systemd.

Since you prefer to build a solid theoretical foundation first, let's begin by understanding systemd's role.

Systemd Explained: How to Manage Linux Services Easily

The video "Systemd Explained" from Learn Linux TV provides an excellent introduction to what systemd is and why it's so important. This clip explains its role as PID 1 and sets the stage for the commands we'll learn.

Watch from the beginning to 04:40. Focus on understanding that systemd is the master process that manages all other services (which it calls 'units') on your system.

The main command you will use to interact with systemd is systemctl. Let's see how to use it to inspect services.

2. Checking Service Status with systemctl

Your first and most important tool for troubleshooting a service is systemctl status. It gives you a comprehensive snapshot of a service's state, including whether it's running, if it's configured to start at boot, and its most recent log entries.

Manage Systemd Services with systemctl on Linux

The DigitalOcean article "Manage Systemd Services with systemctl on Linux" provides a clear, well-structured explanation of how to check the status of a service.

Please read the section titled "Checking the Status of Services". Pay close attention to the example output for the Nginx server and the explanation of what each line means.

As you read, the key command is:
systemctl status <service_name>
For example: systemctl status sshd

The output of this command is packed with useful information. Let's break it down using a visual example.

systemctl status sshd Output with Log Entries
Output of the `systemctl status sshd` command, showing the service is active and running, along with recent log entries detailing failed password attempts.

Here’s what to look for in the output:

  • Loaded: Shows the path to the service's configuration file (its "unit file") and whether the service is enabled (starts at boot), disabled (doesn't start at boot), or static (a dependency of another service).
  • Active: This is the most critical line. It tells you if the service is active (running), inactive (dead), or in a failed state. It also shows how long the service has been in its current state.
  • Main PID: The Process ID of the main service process. You could use this PID with commands like ps or top.
  • Log Snippet: The last few lines of the output show the most recent entries from the system's log that relate to this service. In the image above, you can see several "Failed password" attempts, which is invaluable for quick diagnostics.

Sometimes you just need a quick "yes" or "no" answer. systemctl provides sub-commands for this:

  • systemctl is-active <service_name>: Returns active or inactive.
  • systemctl is-enabled <service_name>: Returns enabled or disabled.

3. Deep Dive into Logs with journalctl

The log snippet in systemctl status is helpful, but it's often not enough. To truly understand what a service has been doing or why it failed, you need to query the systemd journal using the journalctl command. This tool lets you slice and dice the system's logs with precision.

The Akamai Developer video we'll watch provides a great hands-on tour of journalctl.

How To Manage Linux Services with systemctl and journalctl | Sysadmin Basics

First, let's see how to view logs for one specific service. This is the most common use case for journalctl.

Watch the segment from 07:48 to 10:24. The -u (for unit) option is the key to filtering logs for a single service, like journalctl -u sshd.

Tailing Logs in Real-Time

One of the most powerful features of journalctl is the ability to watch logs as they are written, which is essential for monitoring an activity in real-time. This is done with the -f (follow) flag.

How To Manage Linux Services with systemctl and journalctl | Sysadmin Basics

This next clip demonstrates how to use journalctl -f to get a live stream of log entries for a service.

Watch from 10:45 to 11:51. Notice how new log entries for an SSH login attempt appear on the screen instantly. This is analogous to the tail -f command used on traditional log files.

Filtering Logs by Time

When a problem occurred in the past, you don't want to wade through days of logs. The --since and --until flags let you pinpoint the exact time frame you're interested in.

How To Manage Linux Services with systemctl and journalctl | Sysadmin Basics

Finally, let's see how to filter logs by a specific time, which is incredibly useful for investigating past incidents.

Watch from 11:51 to 13:13. The video shows how to use --since with human-readable times like "1 hour ago" or specific timestamps.

For a comprehensive written guide on these journalctl options and more, the article "systemctl: The Complete Guide to Managing Linux Services" (LINK) is an excellent resource. The section "Advanced Service Log Analysis and Filtering Techniques" summarizes these commands nicely.

Test your understanding!

A user reports they couldn't access the company's internal web server (httpd service) around 9:00 AM this morning. The issue seems to be resolved now.

  1. What command would you use to check the current health of the web server?
  2. What command would you use to view all the logs for just the httpd service from today between 8:55 AM and 9:15 AM?
Show answer

  1. To check the current health, you would use:

    systemctl status httpd

  2. To view the logs for that specific time window, you would use:

    journalctl -u httpd --since "08:55" --until "09:15"

    This command filters for the httpd unit (-u) and isolates the log entries to the critical 20-minute window.

4. Viewing All Active Services

Sometimes you need a high-level overview of everything that's running on your system. The list-units command provides this big-picture view.

Manage Systemd Services with systemctl on Linux

To understand the output of list-units, let's return to the DigitalOcean article. It provides a great explanation of each column in the output.

Read the subsection "Listing Current Units". Focus on understanding the meaning of the UNIT, LOAD, ACTIVE, SUB, and DESCRIPTION columns. Also, note the filter --type=service, which is very useful.

To see only the active services, you would run:
systemctl list-units --type=service

This gives you a quick and easy way to audit all the daemons currently running on your machine.

Conclusion

In this lesson, you've moved from managing interactive jobs to inspecting the persistent services that are the lifeblood of a Linux system. You now have the foundational skills to diagnose service-related issues.

Key Takeaways:

  • systemd is the service manager for most modern Linux distributions, and systemctl is your primary tool for interacting with it.
  • systemctl status <service_name> is your go-to command for a quick health check of any service, providing status, boot configuration, and recent log messages all in one place.
  • journalctl is the powerful utility for deep log analysis. Key options include:
    • -u <service_name> to filter for a specific service.
    • -f to follow logs in real-time.
    • --since and --until to filter by time.
  • systemctl list-units --type=service gives you an overview of all currently running services.

Preview of the Next Lesson:

Knowing a service's status is half the battle. The other half is being able to change it. In our next lesson, we will do just that. We'll learn how to control active services (start, stop, restart) and configure them to start at boot, giving you full command over the services on your system.