Service Management with systemd

Manage services, units, and logs with systemd and journald.

systemd is the init system and service manager on virtually all modern distributions. Fluency with systemctl and journalctl is essential for operating production services and is core to certification.

By the end of this chapter you will be able to

Control service lifecycle with systemctl.
Enable/disable services at boot, including enable –now.
Inspect status and logs via systemctl and journalctl.
Understand units, targets, and daemon-reload.
Follow and filter the journal for troubleshooting.

10.1 Controlling Services

Command	Effect
systemctl start nginx	Start it now.
systemctl stop nginx	Stop it now.
systemctl restart nginx	Stop then start.
systemctl reload nginx	Re-read config without dropping connections (if supported).
systemctl status nginx	State + recent log lines.

Day-to-day service control

sudo systemctl start nginx
systemctl status nginx
sudo systemctl restart nginx

10.2 Enabling at Boot

start is for *now*; enable is for *every boot*. Combine them with enable --now.

Boot behaviour

sudo systemctl enable nginx       # start at every boot
sudo systemctl enable --now nginx # enable AND start now
sudo systemctl disable nginx      # don't start at boot
systemctl is-enabled nginx        # check

10.3 Logs with journalctl

Querying the system journal

journalctl -u nginx           # all logs for one service
journalctl -u nginx -e        # jump to the end (most recent)
journalctl -u nginx -f        # follow live, like tail -f
journalctl -p err -b          # errors since this boot
journalctl --since '1 hour ago'

10.4 Units and daemon-reload

A unit file defines a service (where its binary is, how to start it, what to depend on). After editing one, you must reload systemd so it re-reads the file.

Modifying a service

systemctl cat nginx                 # view the unit file
sudo systemctl edit nginx          # safe override drop-in
sudo systemctl daemon-reload       # REQUIRED after unit changes
sudo systemctl restart nginx

10.5 Guided Lab: Operate a Service

Estimated time: 25 minutes. Install a web server, control it with systemd, make it boot-persistent, and read its logs. (Use a VM or test host.)

Install nginx: sudo apt install -y nginx (or sudo dnf install nginx).
Check its state: systemctl status nginx.
Enable and start it for good: sudo systemctl enable --now nginx.
Confirm it serves: curl -I http://localhost (expect HTTP/1.1 200).
Watch its log live in one terminal: journalctl -u nginx -f; reload it in another: sudo systemctl reload nginx.
Stop and disable it to clean up: sudo systemctl disable --now nginx.

Troubleshooting

Symptom	Likely cause and fix
Service is ‘active (running)’ but the app doesn’t work	The process is up but misconfigured. Read journalctl -u <svc> -e and validate the app’s own config (e.g. nginx -t).
‘Failed to start’ after a config change	Syntax error in the config or unit. Check status + journal; validate config; fix; daemon-reload if the unit changed; restart.
Service runs now but not after reboot	You started but didn’t enable it. Run systemctl enable –now <svc>.
Edited unit file but nothing changed	You skipped daemon-reload. Run sudo systemctl daemon-reload, then restart the service.

Practice & Prove It

Write-the-command drills

Enable and immediately start the firewalld service.
Show the last logs for ssh, following new entries live.
Reload systemd after editing a unit file.
Check whether nginx is set to start at boot.
Show all error-priority journal messages from the current boot.

Quick quiz

What’s the difference between start and enable?
Which command shows a service’s status and recent logs?
Which tool reads the system journal?
What must you run after editing a unit file?
What does enable –now do?

Key Takeaways

systemctl controls service lifecycle: start, stop, restart, reload, status.
start is for now; enable is for boot; enable –now does both.
journalctl is the unified log query tool — -u, -e, -f, and -p are your workhorses.
Edit services with systemctl edit drop-ins; always daemon-reload after unit changes.
‘active (running)’ means the process is up — not that the app is configured correctly.

Next — Chapter 11: security and system hardening.