systemd services: systemctl and journalctl basics

On Debian, Ubuntu, RHEL, Rocky Linux, AlmaLinux and most other current distributions, the first process the kernel starts is systemd. It starts everything else: the network, the SSH server, the web server, scheduled jobs. It also keeps watching those programs, restarts them if you tell it to, and collects their output in one log called the journal.

You talk to systemd with two commands: systemctl to control things and journalctl to read the logs.

Units: what systemd manages

Everything systemd manages is a unit, described by a small text file. The suffix tells you the type:

• nginx.service: a program that runs, usually in the background (a daemon).
• backup.timer: a schedule that starts a service, like a cron entry.
• srv-data.mount: a mounted filesystem.
• multi-user.target: a group of units, roughly “the normal server state”.

Packages install their unit files under /usr/lib/systemd/system/ (on older Debian layouts also /lib/systemd/system/). Your own units and overrides belong in /etc/systemd/system/, which takes precedence.

Is it running? Start, stop, restart

systemctl status nginx          # state, main PID, last log lines
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx     # stop + start
sudo systemctl reload nginx      # ask the program to re-read its config

systemctl is-active nginx        # prints active / inactive / failed
systemctl --failed               # every unit that is in the failed state

reload asks the service itself to re-read its configuration without stopping; not every service supports it. It does not re-read the unit file. That is a different command, shown below.

Start at boot: enable and disable

Starting a service and starting it at boot are separate things. enable creates the links that make the unit start at boot; it does not start it now unless you add --now.

sudo systemctl enable --now nginx   # start now and at every boot
sudo systemctl disable nginx        # no longer at boot (still running now)
systemctl is-enabled nginx

sudo systemctl mask nginx           # make it impossible to start
sudo systemctl unmask nginx

Looking at and changing unit files

systemctl cat nginx            # the unit file plus any drop-in overrides
sudo systemctl edit nginx      # create a drop-in override (override.conf)
sudo systemctl daemon-reload   # re-read unit files after editing them by hand
systemctl list-unit-files --type=service

Prefer systemctl edit over editing a packaged unit file directly: the override survives package updates. After editing any unit file by hand, run daemon-reload, or systemd keeps using the old version.

Reading logs with journalctl

Anything a service prints to stdout or stderr ends up in the journal, tagged with the unit name, so you rarely need to hunt for log files.

journalctl -u nginx                  # all logs for one unit
journalctl -u nginx -f               # follow live, Ctrl-C to stop
journalctl -u nginx -n 50            # last 50 lines
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx --since "2026-01-15 08:00" --until "2026-01-15 09:00"
journalctl -b                        # this boot only
journalctl -b -1                     # the previous boot
journalctl -p err -b                 # errors and worse in this boot
journalctl -k                        # kernel messages (like dmesg)
journalctl -xeu nginx                # jump to the end, with explanations

• -p takes a priority name or number: emerg (0), alert, crit, err, warning, notice, info, debug (7). One level includes everything more severe.
• -g PATTERN (--grep) filters the message text with a regular expression.
• -o short-iso prints exact timestamps; -o cat prints only the message text; -o json gives one JSON object per line for scripts.

Is the journal kept after a reboot?

If journalctl --list-boots shows only the current boot, logs are not being stored on disk. The Storage= option in /etc/systemd/journald.conf (or a drop-in under /etc/systemd/journald.conf.d/) controls this; with auto, logs persist only if /var/log/journal exists. Check how much space the journal uses, and trim it, with:

journalctl --disk-usage
sudo journalctl --vacuum-size=500M    # delete oldest archived files above 500 MiB
sudo journalctl --vacuum-time=30d     # delete archived files older than 30 days

Official documentation

• systemctl(1)
• journalctl(1)
• journald.conf(5)