Services and logs (systemd basics)

Goal

Control services confidently and read logs like an operator.

What systemd is (simple)

systemd is the service manager on most modern Linux distros. It starts services, restarts them, manages dependencies, and records logs in the journal.

Core Commands (must know)

Service status

systemctl status nginx
systemctl is-active nginx
systemctl is-enabled nginx

Start/stop/restart

sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx

Enable on boot

sudo systemctl enable nginx
sudo systemctl disable nginx

Logs with journalctl

Follow logs (tail)

sudo journalctl -u nginx -f

Last 200 lines

sudo journalctl -u nginx -n 200 --no-pager

Logs since a time window

sudo journalctl -u nginx --since "1 hour ago" --no-pager

Where are logs stored?

Depends on the service:

• journal (systemd): journalctl
• files: commonly /var/log/ (nginx, auth, syslog)

Quick lookup:

ls -lah /var/log

The Unit File (what runs)

Check how systemd starts the service:

systemctl cat nginx

Look for:

• ExecStart= (the actual command)
• Environment= (important variables)
• User= (permission issues!)
• WorkingDirectory=

Debugging a Failing Service (playbook)

1. Check status (read the last lines)

systemctl status myservice --no-pager

1. Follow logs

journalctl -u myservice -f

1. Confirm config and ports

ss -lntp
curl -v http://localhost:PORT

1. If service starts then dies, read ExecStart and try running it manually.

Exercises

Exercise A: Create a tiny service

1. Create a script:

sudo tee /usr/local/bin/hello-service >/dev/null <<'EOF'
#!/usr/bin/env bash
while true; do
  echo "hello from systemd: $(date -Iseconds)"
  sleep 5
done
EOF
sudo chmod +x /usr/local/bin/hello-service

1. Create a unit file:

sudo tee /etc/systemd/system/hello.service >/dev/null <<'EOF'
[Unit]
Description=Hello demo service

[Service]
ExecStart=/usr/local/bin/hello-service
Restart=always

[Install]
WantedBy=multi-user.target
EOF

1. Start it:

sudo systemctl daemon-reload
sudo systemctl start hello
sudo journalctl -u hello -f

Next Step

Once you can manage services and logs, you can operate real deployments: nginx, docker, and app processes become predictable.