Managing systemd Services

# Start a service
sudo systemctl start nginx

# Stop a service
sudo systemctl stop nginx

# Restart a service (stop + start)
sudo systemctl restart nginx

# Reload configuration without stopping (if supported)
sudo systemctl reload nginx

# Reload or restart — tries reload first, falls back to restart
sudo systemctl reload-or-restart nginx

# Enable a service to start on boot
sudo systemctl enable nginx

# Disable a service from starting on boot
sudo systemctl disable nginx

# Enable AND start in one command
sudo systemctl enable --now nginx

# Disable AND stop in one command
sudo systemctl disable --now nginx

# Detailed status with recent log output
sudo systemctl status nginx

● nginx.service - A high performance web server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-02-24 10:15:32 UTC; 1 day ago
    Process: 1234 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
   Main PID: 1235 (nginx)
      Tasks: 3 (limit: 4614)
     Memory: 8.5M
        CPU: 1.234s
     CGroup: /system.slice/nginx.service
             ├─1235 "nginx: master process /usr/sbin/nginx"
             ├─1236 "nginx: worker process"
             └─1237 "nginx: worker process"

# Check if a service is active (good for scripts)
systemctl is-active nginx

# Check if a service is enabled on boot
systemctl is-enabled nginx

# List all running services
systemctl list-units --type=service --state=running

# List all failed services
systemctl list-units --type=service --state=failed

# List all installed services (including inactive)
systemctl list-unit-files --type=service

# Show the unit file contents
systemctl cat nginx.service

# Show all properties of a service
systemctl show nginx.service

[Unit]
Description=My Node.js Application
Documentation=https://example.com/docs
After=network.target

[Service]
Type=simple
User=deploy
Group=deploy
WorkingDirectory=/home/deploy/myapp
ExecStart=/usr/bin/node server.js
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=myapp
Environment="NODE_ENV=production"
Environment="PORT=3000"

[Install]
WantedBy=multi-user.target

# Reload systemd to pick up the new unit file
sudo systemctl daemon-reload

# Enable and start in one step
sudo systemctl enable --now myapp

# Verify it's running
sudo systemctl status myapp

[Unit]
Description=My Python API
After=network.target

[Service]
Type=simple
User=deploy
Group=deploy
WorkingDirectory=/home/deploy/myapi
ExecStart=/home/deploy/myapi/venv/bin/gunicorn -w 4 -b 0.0.0.0:8000 app:app
Restart=always
RestartSec=3
Environment="PYTHONUNBUFFERED=1"

[Install]
WantedBy=multi-user.target

[Unit]
Description=Run my backup script
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh
StandardOutput=journal

DATABASE_URL=postgresql://user:pass@localhost/mydb
SECRET_KEY=your-secret-key-here
NODE_ENV=production

[Service]
EnvironmentFile=/etc/myapp/env

sudo chmod 600 /etc/myapp/env
sudo chown root:root /etc/myapp/env

[Unit]
Description=My Web Application
After=network.target mariadb.service
Requires=mariadb.service

[Service]
Type=simple
ExecStart=/usr/local/bin/myapp

[Install]
WantedBy=multi-user.target

# Show all logs for a specific service
sudo journalctl -u nginx

# Follow logs in real time (like tail -f)
sudo journalctl -u nginx -f

# Show only the last 50 lines
sudo journalctl -u nginx -n 50

# Show logs since a specific time
sudo journalctl -u nginx --since "2026-02-24 10:00"

# Show logs from the last hour
sudo journalctl -u nginx --since "1 hour ago"

# Show logs from the current boot only
sudo journalctl -u nginx -b

# Show logs from the previous boot
sudo journalctl -u nginx -b -1

# Show only errors and above
sudo journalctl -u nginx -p err

# Priority levels: emerg, alert, crit, err, warning, notice, info, debug

# Show in reverse order (newest first)
sudo journalctl -u nginx -r

# Output as JSON (useful for parsing)
sudo journalctl -u nginx -o json-pretty

# Show logs for multiple services
sudo journalctl -u nginx -u php-fpm

# Show kernel messages
sudo journalctl -k

# Show all logs from a specific PID
sudo journalctl _PID=1234

# Check how much disk space the journal uses
sudo journalctl --disk-usage

# Retain only the last 7 days of logs
sudo journalctl --vacuum-time=7d

# Limit journal size to 500MB
sudo journalctl --vacuum-size=500M

# Remove everything except the 5 most recent log files
sudo journalctl --vacuum-files=5

[Journal]
SystemMaxUse=500M
SystemKeepFree=1G
MaxRetentionSec=30day

sudo systemctl restart systemd-journald

[Unit]
Description=Daily database backup

[Service]
Type=oneshot
User=deploy
ExecStart=/usr/local/bin/backup.sh
StandardOutput=journal

[Unit]
Description=Run backup daily at 3:00 AM

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now backup.timer

# Verify the timer is active
sudo systemctl list-timers

# Check when it will fire next
sudo systemctl status backup.timer

# Validate a timer schedule — shows next trigger times
systemd-analyze calendar "*-*-* 03:00:00"

# Run the service manually to test
sudo systemctl start backup.service

[Service]
# Limit memory usage (kills service if exceeded)
MemoryMax=512M

# Soft memory limit (triggers reclaim)
MemoryHigh=400M

# Limit CPU usage (100% = 1 core)
CPUQuota=50%

# Limit number of tasks/threads
TasksMax=100

# Limit number of open file descriptors
LimitNOFILE=65536

# Limit number of processes
LimitNPROC=4096

# Opens an editor to create a drop-in override
sudo systemctl edit myapp

# Add your overrides between the comments:
# [Service]
# MemoryMax=256M

# The override is saved to:
# /etc/systemd/system/myapp.service.d/override.conf

# Reload after editing
sudo systemctl daemon-reload
sudo systemctl restart myapp

[Service]
# Run as a non-root user
User=deploy
Group=deploy

# Prevent gaining new privileges (e.g., via setuid binaries)
NoNewPrivileges=true

# Make the filesystem read-only except for specific paths
ProtectSystem=strict
ReadWritePaths=/var/www/myapp/data /var/log/myapp

# Hide /home, /root, and /run/user from the service
ProtectHome=true

# Prevent writing to /dev, /proc, /sys
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

# Restrict network access to specific address families
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

# Make /tmp private to this service
PrivateTmp=true

# Prevent the service from accessing /dev devices
PrivateDevices=true

# Score how secure a service configuration is (0 = best, 10 = worst)
systemd-analyze security myapp.service

# 1. Check the status and error messages
sudo systemctl status myapp -l

# 2. View the full log output
sudo journalctl -u myapp -n 100 --no-pager

# 3. Verify the unit file syntax
sudo systemd-analyze verify /etc/systemd/system/myapp.service

# 4. Check if the binary exists and is executable
ls -la /usr/local/bin/myapp
file /usr/local/bin/myapp

# 5. Try running the command manually as the service user
sudo -u deploy /usr/local/bin/myapp

# Show recent failures with exit codes
sudo systemctl status myapp

# Reset the failure counter to try again
sudo systemctl reset-failed myapp
sudo systemctl start myapp

# Show total boot time
systemd-analyze

# Show services sorted by startup time
systemd-analyze blame

# Show the critical chain (what delayed boot)
systemd-analyze critical-chain