Control services and daemons with systemd

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Services starten, stoppen en inschakelen met systemctl

Know systemd and units

systemd manages units. A unit is anything systemd controls; its type is the end of its name.

Unit type	Ends with	Example	What it is
Service	`.service`	`sshd.service`	A daemon or a one-time task
Socket	`.socket`	`cockpit.socket`	Starts a service when a connection comes
Timer	`.timer`	`dnf-makecache.timer`	Starts a service at a time (like cron)
Target	`.target`	`multi-user.target`	A group of units, a "system state"
Mount	`.mount`	`home.mount`	A mounted file system

$systemctl
$systemctl list-units --type=service
$systemctl list-units --type=service --state=running
$systemctl list-unit-files --type=service
$systemctl --failed

Onthoud

You can leave out .service: systemctl status sshd means sshd.service.

16.2

Read the status of a service

systemctl status answers three questions: Is it enabled at boot? Is it active now? What did it log last?

$systemctl status sshd
● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-10-27 08:01:12 +03; 3h 40min ago
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 1022 (sshd)
      Tasks: 1 (limit: 23138)
     Memory: 5.2M
        CPU: 312ms
     CGroup: /system.slice/sshd.service
             └─1022 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
 
Oct 27 11:30:44 server1 sshd[4318]: Accepted publickey for student from 192.168.122.1 port 50122 ssh2

You see	Meaning
`enabled` / `disabled`	Starts / does not start at boot
`active (running)`	Runs now
`active (exited)`	A one-time task that finished OK
`inactive (dead)`	Not running
`failed`	Crashed or could not start — read the log lines
`static`	Can not be enabled; another unit starts it
`masked`	Blocked: can not start at all

For scripts there are short yes/no checks:

$systemctl is-active sshd
active
$systemctl is-enabled sshd
enabled
$systemctl is-failed httpd

16.3

Start, stop and restart

start / stop change the service now. They do not change what happens at the next boot.

#systemctl start httpd
#systemctl stop httpd
#systemctl restart httpd
#systemctl reload httpd
#systemctl reload-or-restart httpd
#systemctl try-restart chronyd

Command	What it does
`restart`	Stop and start: new process, short break for users
`reload`	Read the config again without stopping (only if the service supports it)
`reload-or-restart`	Reload if possible, else restart
`try-restart`	Restart only if it runs already

Op het werk

After a config change, check the syntax first (httpd -t, sshd -t, nginx -t), then reload. A broken config plus restart = the service is down.

16.4

Enable a service at boot

enable makes the service start at every boot. --now also starts it at once. disable does the opposite.

#systemctl enable httpd
Created symlink '/etc/systemd/system/multi-user.target.wants/httpd.service' → '/usr/lib/systemd/system/httpd.service'.
#systemctl enable --now httpd
#systemctl disable --now httpd
#systemctl is-enabled httpd

Examentip

A task says "the service must run and start after a reboot"? Always systemctl enable --now SERVICE. Then check with systemctl status.

Onthoud

start = now. enable = at boot. enable --now = both.

16.5

Block a service with mask

mask links a unit to /dev/null, so nobody — not even another service — can start it. Use it for services that must never run.

#systemctl mask --now nftables
Created symlink '/etc/systemd/system/nftables.service' → '/dev/null'.
#systemctl start nftables
Failed to start nftables.service: Unit nftables.service is masked.
#systemctl unmask nftables

Notitie

firewalld and the nftables service both load firewall rules. When you use firewalld, masking nftables stops anybody from starting the second one by mistake.

16.6

Find why a service fails

The answer is almost always in the journal of the service.

#systemctl status httpd -l --no-pager
#journalctl -u httpd -n 50 --no-pager
#journalctl -u httpd -b -p err
#journalctl -u httpd -f
#httpd -t
#systemctl list-dependencies httpd
#systemctl cat httpd

A good order of checks:

systemctl status SERVICE — the last log lines and the exit code.
journalctl -u SERVICE -n 50 — more of the log.
Check the config syntax with the program's own test option.
Check the port: is another program already on it? ss -tlpn.
Check SELinux: ausearch -m AVC -ts recent (explained in Protect services with SELinux).

16.7

Know where unit files live

Unit files from packages are in /usr/lib/systemd/system/. Your own files and changes go to /etc/systemd/system/ — they win.

$systemctl cat sshd
# /usr/lib/systemd/system/sshd.service
[Unit]
Description=OpenSSH server daemon
After=network.target sshd-keygen.target
[Service]
ExecStart=/usr/sbin/sshd -D $OPTIONS
Restart=on-failure
[Install]
WantedBy=multi-user.target
#systemctl edit httpd
#systemctl daemon-reload

systemctl edit SERVICE opens an empty drop-in file (/etc/systemd/system/SERVICE.d/override.conf). Only your lines change the unit; package updates do not overwrite them.
After you change a unit file by hand, run systemctl daemon-reload.

More: Write your own service.

Oefenen

Lab 11.1Manage and change servicesGemiddeld · 30 minNog niet begonnen

Oefenen

Alle commando's in dit hoofdstuk