Complete Guide to Linux systemd Service Management for Absolute Beginners

Introduction

systemd is the modern init system and service manager for Linux, replacing older SysV init and Upstart systems. It's responsible for starting services during boot, managing running services, and handling system state transitions. Understanding systemd is essential for managing Linux servers and workstations.

In this comprehensive guide, you'll learn:

• Listing and filtering systemd services
• Checking service status with detailed output interpretation
• Starting, stopping, and restarting services
• Enabling and disabling services for automatic startup
• Viewing and understanding systemd unit files
• Analyzing service dependencies
• Monitoring service logs with journalctl

Understanding systemd Units

systemd manages different types of units:

Listing Running Services

To view all currently running services:

systemctl list-units --type=service --state=running

Command Breakdown:

• systemctl: Main command for controlling systemd
• list-units: List all loaded units
• --type=service: Filter to show only service units
• --state=running: Show only running services

Partial Output:

  UNIT                          LOAD   ACTIVE SUB     DESCRIPTION
  accounts-daemon.service       loaded active running Accounts Service
  alsa-state.service            loaded active running Manage Sound Card State (restore and store)
  atd.service                   loaded active running Deferred execution scheduler
  auditd.service                loaded active running Security Auditing Service
  avahi-daemon.service          loaded active running Avahi mDNS/DNS-SD Stack
  chronyd.service               loaded active running NTP client/server
  colord.service                loaded active running Manage, Install and Generate Color Profiles
  containerd.service            loaded active running containerd container runtime
  crond.service                 loaded active running Command Scheduler
  cups.service                  loaded active running CUPS Scheduler
  dbus-broker.service           loaded active running D-Bus System Message Bus
  docker.service                loaded active running Docker Application Container Engine
  firewalld.service             loaded active running firewalld - dynamic firewall daemon
  gdm.service                   loaded active running GNOME Display Manager
  NetworkManager.service        loaded active running Network Manager
  sshd.service                  loaded active running OpenSSH server daemon
  systemd-journald.service      loaded active running Journal Service
  systemd-logind.service        loaded active running User Login Management
  systemd-udevd.service         loaded active running Rule-based Manager for Device Events and Files

Understanding Column Headers

Footer Summary:

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
36 loaded units listed.

This shows 36 service units are currently running on the system.

Common Service Types:

• System Services: auditd (security), chronyd (time sync), crond (scheduling)
• Network Services: sshd (SSH server), NetworkManager (networking)
• Desktop Services: gdm (display manager), accounts-daemon (user accounts)
• Container Services: docker, containerd
• Core systemd Services: systemd-journald (logging), systemd-logind (login)

Checking Service Status

The systemctl status command provides detailed information about a service:

systemctl status sshd

Output:

● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: active (running) since Mon 2025-10-06 15:43:12 PKT; 3h 18min ago
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 1861 (sshd)
      Tasks: 1 (limit: 48732)
     Memory: 2.0M (peak: 2.3M)
        CPU: 31ms
     CGroup: /system.slice/sshd.service
             └─1861 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Oct 06 15:43:12 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on 0.0.0.0 port 22.
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on :: port 22.
Oct 06 15:43:12 localhost.localdomain systemd[1]: Started OpenSSH server daemon.

Detailed Status Output Explanation

Line 1: Service Header

● sshd.service - OpenSSH server daemon

• ●: Green dot indicates active/running (○ would mean inactive)
• sshd.service: Full service unit name
• OpenSSH server daemon: Service description

Line 2: Load Status

Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)

Line 3: Active Status

Active: active (running) since Mon 2025-10-06 15:43:12 PKT; 3h 18min ago

Documentation Links:

Docs: man:sshd(8)
      man:sshd_config(5)

• Provides manual page references for the service
• man sshd for daemon documentation
• man sshd_config for configuration file documentation

Process Information:

Main PID: 1861 (sshd)
Tasks: 1 (limit: 48732)
Memory: 2.0M (peak: 2.3M)
CPU: 31ms

CGroup (Control Group):

CGroup: /system.slice/sshd.service
        └─1861 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

• CGroup path: /system.slice/sshd.service - hierarchical resource control
• Process tree: Shows PID 1861 with full command line
• -D: Run in foreground (don't daemonize)
• [listener]: Current state (listening for connections)

Recent Logs (Last Few Lines):

Oct 06 15:43:12 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on 0.0.0.0 port 22.
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on :: port 22.
Oct 06 15:43:12 localhost.localdomain systemd[1]: Started OpenSSH server daemon.

Log Interpretation:

1. systemd initiating service start
2. sshd binding to IPv4 (0.0.0.0) port 22
3. sshd binding to IPv6 (::) port 22
4. systemd confirming successful start

Stopping Services

The systemctl stop command stops a running service:

sudo systemctl stop sshd

Why sudo is Required:

• Stopping system services requires root privileges
• Regular users cannot control system-wide services
• Protects critical services from accidental termination

Verifying the Stop:

systemctl status sshd

Output:

○ sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: inactive (dead) since Mon 2025-10-06 19:03:51 PKT; 5s ago
   Duration: 3h 20min 39.015s
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 1861 ExecStart=/usr/sbin/sshd -D $OPTIONS (code=exited, status=0/SUCCESS)
   Main PID: 1861 (code=exited, status=0/SUCCESS)
        CPU: 35ms

Oct 06 15:43:12 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on 0.0.0.0 port 22.
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on :: port 22.
Oct 06 15:43:12 localhost.localdomain systemd[1]: Started OpenSSH server daemon.
Oct 06 19:03:51 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:03:51 vbox sshd[1861]: Received signal 15; terminating.
Oct 06 19:03:51 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:03:51 vbox systemd[1]: Stopped OpenSSH server daemon.

Understanding Stopped Service Status

Key Changes from Running State:

Stop Sequence in Logs:

1. Stopping OpenSSH server daemon... - systemd initiates stop
2. Received signal 15; terminating. - sshd receives SIGTERM (graceful shutdown)
3. Deactivated successfully. - Service cleanly deactivated
4. Stopped OpenSSH server daemon. - Stop complete

Starting Services

The systemctl start command starts a stopped service:

sudo systemctl start sshd

Checking After Start:

systemctl status sshd

Output:

● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: active (running) since Mon 2025-10-06 19:04:06 PKT; 5s ago
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 31364 (sshd)
      Tasks: 1 (limit: 48732)
     Memory: 1.5M (peak: 1.8M)
        CPU: 21ms
     CGroup: /system.slice/sshd.service
             └─31364 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Oct 06 19:04:05 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:06 vbox sshd[31364]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:06 vbox sshd[31364]: Server listening on :: port 22.
Oct 06 19:04:06 vbox systemd[1]: Started OpenSSH server daemon.

What Changed:

• New PID: 31364 (was 1861) - fresh process created
• Active: Now active (running) with green ●
• Fresh logs: Shows recent start sequence
• Memory reset: 1.5M current (new process baseline)

Restarting Services

The systemctl restart command stops and then starts a service:

sudo systemctl restart sshd

When to Use Restart:

• After modifying configuration files
• To clear service state/memory
• To apply updates without full reload
• To resolve stuck processes

Restart vs Stop/Start:

• Restart: Atomic operation, minimal downtime
• Stop then Start: Separate operations, can verify stop before starting

Enabling Services for Auto-Start

The systemctl enable command configures a service to start automatically at boot:

sudo systemctl enable sshd

What This Does:

• Creates symbolic links in systemd directories
• Registers service to start during boot sequence
• Does NOT start the service immediately (use systemctl enable --now for both)

Verification:

systemctl status sshd

Relevant Line:

Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)

The enabled status confirms the service will start at boot.

How Enable Works: When you enable a service, systemd creates a symbolic link:

/etc/systemd/system/multi-user.target.wants/sshd.service → /usr/lib/systemd/system/sshd.service

This links the service to the multi-user.target (like runlevel 3 in SysV), ensuring it starts when the system reaches multi-user mode.

Disabling Services

The systemctl disable command prevents a service from starting automatically at boot:

sudo systemctl disable sshd

Output:

Removed "/etc/systemd/system/multi-user.target.wants/sshd.service".

What Happened:

• Removed symbolic link from target directory
• Service will NOT start automatically at boot
• Service remains running if currently active (disable ≠ stop)

Verification:

systemctl status sshd

Output:

● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; preset: enabled)
     Active: active (running) since Mon 2025-10-06 19:04:18 PKT; 34s ago

Key Observations:

• Loaded status: Now shows disabled (was enabled)
• Active status: Still active (running) - disable doesn't stop service
• Preset: enabled means system default wants it enabled (but manually disabled)

Viewing Service Unit Files

The systemctl cat command displays the service unit file:

systemctl cat sshd

Output:

# /usr/lib/systemd/system/sshd.service
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target

Understanding Unit File Sections

[Unit] Section - General Information

[Service] Section - Service Behavior

[Install] Section - Enable/Disable Behavior

Service Type Values:

• simple: Exec command is main process (default)
• forking: Service spawns child process (traditional daemons)
• oneshot: Process exits after start (initialization tasks)
• notify: Service sends ready notification to systemd (like sshd)

Analyzing Service Dependencies

The systemctl list-dependencies command shows what a service depends on:

systemctl list-dependencies sshd

Output (Partial):

sshd.service
● ├─system.slice
● ├─sshd-keygen.target
○ │ ├─sshd-keygen@ecdsa.service
○ │ ├─sshd-keygen@ed25519.service
○ │ └─sshd-keygen@rsa.service
● └─sysinit.target
●   ├─dev-hugepages.mount
●   ├─dev-mqueue.mount
●   ├─dracut-shutdown.service
...
●   ├─systemd-journald.service
●   ├─systemd-modules-load.service
●   ├─systemd-udevd.service
●   ├─cryptsetup.target
●   ├─local-fs.target

Understanding Dependencies

Dependency Tree Structure:

• ● = Active/loaded dependency
• ○ = Inactive dependency
• Tree shows hierarchical relationships

Key Dependencies for sshd:

Dependency Types in systemd:

• Requires: Strong dependency - failure stops this unit
• Wants: Weak dependency - failure doesn't affect this unit
• After: Ordering - start after these units
• Before: Ordering - start before these units

Viewing Service Logs with journalctl

systemd uses journald for centralized logging. The journalctl command queries these logs.

Viewing All Logs for a Service

sudo journalctl -u sshd

Command Breakdown:

• journalctl: Query systemd journal
• -u sshd: Filter for unit sshd (service)

Output:

Oct 06 15:43:12 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on 0.0.0.0 port 22.
Oct 06 15:43:12 localhost.localdomain sshd[1861]: Server listening on :: port 22.
Oct 06 15:43:12 localhost.localdomain systemd[1]: Started OpenSSH server daemon.
Oct 06 19:03:51 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:03:51 vbox sshd[1861]: Received signal 15; terminating.
Oct 06 19:03:51 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:03:51 vbox systemd[1]: Stopped OpenSSH server daemon.
Oct 06 19:04:05 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:06 vbox sshd[31364]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:06 vbox sshd[31364]: Server listening on :: port 22.
Oct 06 19:04:06 vbox systemd[1]: Started OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31364]: Received signal 15; terminating.
Oct 06 19:04:18 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:04:18 vbox systemd[1]: Stopped OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31380]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:18 vbox sshd[31380]: Server listening on :: port 22.
Oct 06 19:04:18 vbox systemd[1]: Started OpenSSH server daemon.

Log Format:

• Timestamp: Oct 06 19:04:18
• Hostname: vbox
• Process: systemd[1] or sshd[31380]
• Message: Actual log entry

Time-Based Filtering

sudo journalctl -u sshd --since "1 hour ago"

Output (Last Hour Only):

Oct 06 19:03:51 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:03:51 vbox sshd[1861]: Received signal 15; terminating.
Oct 06 19:03:51 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:03:51 vbox systemd[1]: Stopped OpenSSH server daemon.
Oct 06 19:04:05 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:06 vbox sshd[31364]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:06 vbox sshd[31364]: Server listening on :: port 22.
Oct 06 19:04:06 vbox systemd[1]: Started OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31364]: Received signal 15; terminating.
Oct 06 19:04:18 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:04:18 vbox systemd[1]: Stopped OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31380]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:18 vbox sshd[31380]: Server listening on :: port 22.
Oct 06 19:04:18 vbox systemd[1]: Started OpenSSH server daemon.

Time Filter Options:

• --since "2024-10-06 18:00:00": Specific datetime
• --since "1 hour ago": Relative time
• --since "today": Today's logs
• --since "yesterday": Yesterday's logs
• --until "10 minutes ago": Up to a time
• --since "30 min ago" --until "10 min ago": Time range

Following Logs in Real-Time

sudo journalctl -u sshd -f

Command Options:

• -f: Follow mode (like tail -f)
• Shows existing logs, then streams new entries

Output:

Oct 06 19:04:06 vbox sshd[31364]: Server listening on :: port 22.
Oct 06 19:04:06 vbox systemd[1]: Started OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Stopping OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31364]: Received signal 15; terminating.
Oct 06 19:04:18 vbox systemd[1]: sshd.service: Deactivated successfully.
Oct 06 19:04:18 vbox systemd[1]: Stopped OpenSSH server daemon.
Oct 06 19:04:18 vbox systemd[1]: Starting OpenSSH server daemon...
Oct 06 19:04:18 vbox sshd[31380]: Server listening on 0.0.0.0 port 22.
Oct 06 19:04:18 vbox sshd[31380]: Server listening on :: port 22.
Oct 06 19:04:18 vbox systemd[1]: Started OpenSSH server daemon.
^C

Press Ctrl+C to stop following.

Use Cases for -f:

• Real-time monitoring during troubleshooting
• Watching service behavior during testing
• Observing connection attempts to SSH
• Monitoring service starts/stops

Best Practices for systemd Service Management

Service Control Best Practices

1. Always Check Status Before Actions

   systemctl status service_name  # Before start/stop/restart
   

   Copy
   • Verify current state
   • Check for errors
   • Note the PID for troubleshooting

2. Use Reload Instead of Restart When Possible

   systemctl reload nginx  # Reload config without dropping connections
   

   Copy
   • Some services support reload (SIGHUP)
   • Less disruptive than restart
   • Check if service supports reload first

3. Combine Enable and Start

   sudo systemctl enable --now service_name  # Enable AND start
   

   Copy
   • Saves a command
   • Ensures immediate operation and persistence

4. Verify After Making Changes

   systemctl status service_name  # After any change
   journalctl -u service_name -n 20  # Check recent logs
   

   Copy

Security and Stability Practices

1. Don't Disable Critical Services

   • Never disable: systemd-journald, systemd-logind, dbus
   • Understand dependencies before disabling
   • Check with systemctl list-dependencies

2. Test Configuration Changes

   sudo systemctl daemon-reload  # After editing unit files
   sudo systemctl restart service_name  # Apply changes
   systemctl status service_name  # Verify success
   

   Copy

3. Monitor Failed Services

   systemctl --failed  # List all failed units
   systemctl reset-failed  # Clear failed state after fixing
   

   Copy

4. Use Masking for Permanent Disable

   sudo systemctl mask service_name  # Prevent all starts
   sudo systemctl unmask service_name  # Remove mask
   

   Copy
   • Masked services cannot be started (even manually)
   • Use for services that conflict with alternatives

Logging and Troubleshooting Practices

1. Check Logs When Services Fail

   journalctl -u service_name -n 50  # Last 50 lines
   journalctl -u service_name --since "5 min ago"  # Recent
   journalctl -xe  # System-wide errors with explanation
   

   Copy

2. Set Log Retention

   # Edit /etc/systemd/journald.conf
   SystemMaxUse=500M  # Max disk space for logs
   MaxRetentionSec=1month  # Keep logs for 1 month
   

   Copy

3. Filter by Priority

   journalctl -p err  # Only errors
   journalctl -p warning -u service_name  # Warnings for specific service
   

   Copy
   • Priorities: emerg, alert, crit, err, warning, notice, info, debug

4. Export Logs for Analysis

   journalctl -u service_name --since today --no-pager > service.log
   

   Copy

Operational Best Practices

1. Document Custom Services

   • Maintain README for custom unit files
   • Document dependencies and configuration
   • Note restart/reload behavior

2. Use Targets for Group Management

   systemctl isolate multi-user.target  # Text mode
   systemctl isolate graphical.target  # GUI mode
   

   Copy

3. Schedule Maintenance Windows

   • Restart services during low-traffic periods
   • Use timers for periodic tasks instead of cron
   • Test in staging before production

4. Backup Configuration

   cp /etc/systemd/system/service_name.service /root/backup/
   

   Copy
   • Backup before modifying unit files
   • Version control custom units

Command Cheat Sheet

Basic Service Control

Enable/Disable Services

Listing and Querying

journalctl Log Commands

System State Commands

Summary

In this comprehensive guide, you've mastered systemd service management:

✅ Understanding systemd units and service types ✅ Listing services with filters for state and type ✅ Checking detailed service status with full interpretation ✅ Starting, stopping, and restarting services effectively ✅ Enabling and disabling services for boot persistence ✅ Viewing and understanding unit file structure ✅ Analyzing service dependencies and relationships ✅ Monitoring service logs with journalctl and time filters ✅ Following best practices for service management and troubleshooting

systemd is the foundation of modern Linux service management. Mastering systemctl and journalctl commands gives you complete control over system services, enabling efficient administration, troubleshooting, and optimization.

What's Next?

Expand your systemd knowledge with these advanced topics:

• Creating Custom Services: Write your own systemd unit files
• Timers: Replace cron with systemd timers for scheduled tasks
• Targets and Runlevels: Understanding system boot states
• Resource Control: Using cgroups for CPU, memory limits
• Socket Activation: On-demand service activation

Master systemd to manage services like a professional Linux administrator!