systemd in one sitting

general / published / guide #29 / ≈ 4 min read

Almost every Linux distribution today (Debian, Mint, Manjaro, Arch, Fedora, openSUSE, Ubuntu) uses systemd to start and supervise the programs that keep your machine running. If you've ever typed sudo systemctl restart something and felt unsure what it actually does, this guide is for you.

What is systemd? It's the very first program the kernel starts at boot. Its job is to bring up every service in the right order, restart things that crash, log what they say, and shut everything down cleanly when you power off. The word "daemon" is just Unix slang for "a program that runs in the background"; the d at the end of names like sshd or crond stands for daemon.

The two commands you'll use 95% of the time

systemctl   # control services
journalctl  # read the logs they produce

That's really it. Everything below is variations on those two.

Services: start, stop, restart, check

sudo systemctl start sshd            # start it right now
sudo systemctl stop sshd             # stop it right now
sudo systemctl restart sshd          # stop then start
sudo systemctl reload sshd           # re-read config without dropping connections
systemctl status sshd                # is it running? what did it say recently?

Notice that status doesn't need sudo — reading is allowed for everyone.

Enable vs start (the most common confusion)

  • start — run the service right now. Goes away on reboot.
  • enable — arrange for the service to start automatically at every boot. Doesn't start it now.

You usually want both:

sudo systemctl enable --now sshd

--now is a shortcut meaning "and also start it this instant."

The opposite pair:

sudo systemctl disable --now sshd

Seeing what's running and what's broken

systemctl list-units --type=service          # everything currently loaded
systemctl --failed                           # anything that crashed
systemctl list-unit-files --state=enabled    # what's set to autostart

--failed is the first place to look if "something stopped working after a reboot."

Logs: journalctl

systemd captures everything every service prints. Read it with journalctl.

journalctl -u sshd                 # logs for one service
journalctl -u sshd -f              # follow new lines as they arrive (like tail -f)
journalctl -u sshd --since "1 hour ago"
journalctl -b                      # only logs since the current boot
journalctl -p err -b               # only errors since boot
journalctl -k                      # kernel messages (same as dmesg)

-u = unit (= service), -f = follow, -b = boot, -p = priority. Combine them as needed.

Unit files: where services are defined

A "unit file" is a plain-text recipe describing how to run a service. They live in two places:

  • /usr/lib/systemd/system/ — installed by your distribution. Don't edit these directly — your changes get overwritten on update.
  • /etc/systemd/system/ — your own customisations. Anything here overrides the system copy.

To safely tweak a vendor service, use edit:

sudo systemctl edit sshd

That opens an empty file under /etc/systemd/system/sshd.service.d/override.conf. Add only what you want to change. After saving:

sudo systemctl daemon-reload         # tell systemd to re-read unit files
sudo systemctl restart sshd          # pick up the new settings

Timers (cron alternative)

systemd has a built-in scheduler called timers. They're a more modern replacement for cron jobs — see the separate cron and systemd timers guide for the details.

systemctl list-timers                # show every scheduled task and when it fires next

Targets: the systemd equivalent of "runlevels"

A target is a bundle of services that get started together. The interesting ones:

  • multi-user.target — full text-mode system, networking up.
  • graphical.target — multi-user + a desktop login screen.
  • rescue.target — single-user emergency mode.
systemctl get-default                       # what does this machine boot into?
sudo systemctl set-default multi-user.target # boot to text mode next time
sudo systemctl isolate rescue.target        # switch right now

Servers without a graphical login set multi-user.target as the default. Desktops use graphical.target.

Reboot, shutdown, hibernate

sudo systemctl reboot
sudo systemctl poweroff
sudo systemctl suspend
sudo systemctl hibernate

Same as the older reboot/shutdown commands, just spelled through systemctl.

When something won't start, the routine

  1. systemctl status servicename — read the last few log lines.
  2. journalctl -u servicename -n 50 — read more (last 50 lines).
  3. Fix whatever the error says (usually a typo in a config file or a missing file).
  4. sudo systemctl restart servicename.

That loop handles 90% of "my service won't come up" problems.

← back to index