Command library / systemctl

Inspect and control system services

The front end to systemd, which starts and supervises almost everything on a modern Linux host. For a defender it answers two questions quickly: is this service healthy right now (status shows its state and latest log lines), and what is set to start automatically at boot, which is one of the first places to look for persistence.

Usage

Options and flags

• command

  what to do: status, is-enabled, list-units, list-unit-files…

• unit

  the service (unit) it applies to, e.g. nginx or nginx.service

• -t, --type TYPE

  only units of this type, e.g. service or timer

• --state STATE

  only units in this state, e.g. running, failed or enabled

• --no-pager

  print everything at once instead of opening a pager

Examples

• systemctl status nginx

  Is nginx running? Shows its state, main PID and latest log lines.

• systemctl is-enabled nginx

  Will nginx start by itself at the next boot?

• systemctl list-units --type=service --state=running

  Every service running right now.

• systemctl list-units --state=failed

  Every unit that has failed: a good first look after a bad boot.

• systemctl list-unit-files --type=service --state=enabled

  Every service set to start at boot.

Common mistakes

Related commands