How to search

Plain words find names, texts and examples.
"two words" finds the exact phrase.
--name or -x finds an option.
#word looks only inside commands.
@grep finds lessons and labs that use grep.
Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
↑ ↓ to move · Enter to open · Esc to close · / to search

`systemctl`

Control systemd: start, stop, enable and check services and other units, change targets, reboot and power off.

Level: RHCSA exam
Group: Services and boot
Needs root: For changes
Package: systemd

What it does

systemctl COMMAND UNIT is the main tool for services on RHEL. start/stop/restart act now; enable/disable decide what starts at boot; status shows the state and the last log lines. Without a type, a name means .service.

It also lists units, shows and edits unit files (cat, edit), sets the default boot target, and powers the system off or reboots it. With --user it manages the services of your own user session.

How to write it

systemctl [OPTION]... COMMAND [UNIT]...

Main parts

Units now

start UNIT...: Start units.
stop UNIT...: Stop units.
restart UNIT...: Stop and start.
try-restart UNIT...: Restart only if running.
reload UNIT...: Re-read the config without stopping.
reload-or-restart UNIT...: Reload if possible, else restart.
kill UNIT...: Send a signal to the processes of a unit.
clean UNIT...: Remove cache, logs, state of a unit.
freeze / thaw UNIT...: Pause / continue all processes of a unit.
isolate TARGET: Start this target and stop all others.

Boot

enable UNIT...: Start at boot (--now also starts now).
disable UNIT...: Do not start at boot.
reenable UNIT...: Disable and enable again (new links).
preset UNIT...: Set enabled/disabled to the preset of the vendor.
mask UNIT...: Block the unit completely (link to /dev/null).
unmask UNIT...: Remove the block.
get-default: Show the default boot target.
set-default TARGET: Set the default boot target.

State

status [UNIT...|PID...]: State, PID, cgroup and last log lines.
is-active UNIT...: Print active/inactive (exit code 0 = active).
is-enabled UNIT...: Print enabled/disabled/static/masked.
is-failed UNIT...: Check for the failed state.
is-system-running: Overall state: running, degraded …
list-units: Loaded units (-t type, --state).
list-unit-files: Installed unit files and their enable state.
list-dependencies UNIT: Dependency tree.
list-sockets, list-timers, list-jobs, list-automounts, list-paths: Lists of these types.
show UNIT: All properties (-p some).

Unit files

cat UNIT...: Show the unit file and drop-ins.
edit UNIT: Create a drop-in override (--full = whole copy).
revert UNIT...: Remove your overrides.
daemon-reload: Reload all unit files after manual changes.
set-property UNIT NAME=VALUE...: Change resource settings (like MemoryMax) at run time and keep them.
link FILE, add-wants, add-requires: Other unit file commands.
set-environment, unset-environment, show-environment: Environment of the manager.

System

reboot: Reboot.
poweroff: Power off.
halt: Stop the system without power off.
suspend, hibernate, hybrid-sleep: Sleep modes.
rescue: Go to rescue mode.
emergency: Go to emergency mode.
default: Go to the default target.
soft-reboot: Restart user space only (newer systemd).
reset-failed [UNIT...]: Clear the failed state.

Options 57

Most used

Select

-t, --type=TYPE: Unit type: service, socket, target, timer, mount …
--state=STATE: Only units in this state: running, failed, enabled …
-a, --all: Also inactive units and empty properties.
--failed: Same as --state=failed.
-r, --recursive: Also units of containers.
--reverse: With list-dependencies: who depends on this unit.
--after, --before: With list-dependencies: order instead of needs.
--with-dependencies: Also act on the dependencies.

Output

-p, --property=NAME: Only these properties with show.
-P NAME: Only the value of one property.
--value: With show: only the values.
-l, --full: Do not cut long lines.
-n, --lines=N: Number of log lines in status.
-o, --output=MODE: Format of the log lines (short, json, cat …).
--plain: Lists without tree lines.
--no-legend, --legend=BOOL: Without header and footer.
--no-pager: Do not use a pager.
--timestamp=FORMAT: Format of time stamps.
--show-types: Show the type of sockets.
-q, --quiet: Less output.
--no-warn: No warnings.

Behaviour

--now: With enable/disable/mask: also start or stop now.
--user: Manage your user services.
--system: Manage system services (default).
--global: With enable: for all users.
--runtime: Change only until the next reboot.
--no-block: Do not wait for the job to finish.
--wait: Wait until the started units end.
--job-mode=MODE: How to handle other queued jobs.
-T, --show-transaction: Show all jobs that a start adds.
--dry-run: Show what would happen.
--no-reload: With enable/disable: no daemon-reload.
--no-ask-password: Do not ask for passwords.
--no-wall: No message to users at reboot.
--message=TEXT: A reason for reboot or poweroff (logged).
--when=TIME: Plan a reboot or poweroff at this time (newer systemd).
-f, --force: Force (with enable: overwrite links; reboot -ff: now).
-i, --check-inhibitors=MODE: Respect or ignore inhibitor locks.
--fail: With start: fail if other jobs conflict.
--kill-whom=main|control|all: With kill: which processes.
-s, --signal=SIGNAL: With kill: the signal.
--kill-value=INT: A value with the signal.
--what=TYPE: With clean: which data (cache, logs, state …).
--preset-mode=MODE: With preset: full, enable-only, disable-only.
--firmware-setup: Reboot into the UEFI setup.
--boot-loader-menu=TIME: Show the boot menu at the next boot.
--boot-loader-entry=ID: Boot this entry next time.
--reboot-argument=ARG: Argument for the reboot.
--mkdir: Create folders with bind/start.
--marked: Act on units marked for restart.
--read-only: Bind mounts read only.
--drop-in=NAME: Name of the file for edit.
--root=PATH, --image=PATH, --image-policy=POLICY: Work on another root or image.
-H, --host=HOST: Control another host over SSH.
-M, --machine=NAME: Control a container.
-h, --help: Show help.
--version: Show the version.

Examples 15

$ run as a normal user# run as root (or with sudo)

1Start a service now and at boot

#systemctl enable --now httpd
Created symlink '/etc/systemd/system/multi-user.target.wants/httpd.service' → '/usr/lib/systemd/system/httpd.service'.

The RHCSA way: running now and after reboot.

2Status of a service
```
$systemctl status sshd
```
Loaded/enabled, Active, Main PID and the last 10 log lines.

3Short checks for scripts

$systemctl is-active httpd; systemctl is-enabled httpd
active
enabled

The exit code is 0 when the answer is yes.

4Restart and reload
```
#systemctl restart httpd
#systemctl reload httpd
```
reload keeps open connections; not every service supports it.
5Find failed services
```
$systemctl --failed
```
Start here after a boot with problems.

6List running services

$systemctl list-units -t service --state=running

What runs now.

7Which services start at boot?
```
$systemctl list-unit-files -t service --state=enabled
```
Review this list: fewer services = smaller attack surface.
8Override settings safely
```
#systemctl edit httpd
#systemctl cat httpd
```
The drop-in goes to /etc/systemd/system/httpd.service.d/.
9Block a service
```
#systemctl mask --now cups
```
Not even a dependency can start it.

10Default boot target

$systemctl get-default
#systemctl set-default multi-user.target

Text mode at the next boot.

11Show some properties

$systemctl show sshd -p MainPID,ActiveState,Restart

Good for scripts and checks.

12Limit memory of a service at run time
```
#systemctl set-property httpd MemoryMax=1G
```
Kept after reboot (use --runtime for a test).
13Rate the security of a service
```
$systemd-analyze security sshd
```
Exposure score from 0 (safe) to 10 (unsafe).
14Your own user services
```
$systemctl --user list-units -t service
```
Services in your session (like podman containers with Quadlet).
15Reboot with a reason
```
#systemctl reboot --message="Kernel update KB-2026-10"
```
The reason goes to the journal.

Watch out

start alone does not survive a reboot; enable alone does not start now.
After editing unit files by hand, run systemctl daemon-reload.
isolate stops everything that is not part of the target (also your SSH session in rescue).

Files

/usr/lib/systemd/system/: Unit files from packages.
/etc/systemd/system/: Your units, overrides and enable links.
/run/systemd/system/: Run-time units.
~/.config/systemd/user/: User units.

Exit codes

0 :: Done (is-active/is-enabled: yes). 1 :: Failed or not active/enabled (also used by status for a dead unit with a pid file). 3 :: status: the unit is not active. 4 :: No such unit.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man systemctl

Open the man page (linux.die.net)www.freedesktop.org

systemctl

What it does

How to write it

Main parts

Units now

Boot

State

Unit files

System

Options 57

Select

Output

Behaviour

Examples 15

1Start a service now and at boot

2Status of a service

3Short checks for scripts

4Restart and reload

5Find failed services

6List running services

7Which services start at boot?

8Override settings safely

9Block a service

10Default boot target

11Show some properties

12Limit memory of a service at run time

13Rate the security of a service

14Your own user services

15Reboot with a reason

Watch out

Files

Exit codes

Related commands

Used in these lessons

Used in these labs

Full manual

`systemctl`