Linux Cheatsheet 05 — systemd

systemctl status nginx
systemctl start nginx
systemctl stop nginx
systemctl restart nginx
systemctl reload nginx           # if supported
systemctl enable nginx           # start on boot
systemctl disable nginx
systemctl enable --now nginx     # enable + start
systemctl is-active nginx
systemctl is-enabled nginx
systemctl is-failed nginx

systemctl list-units
systemctl list-units --type=service
systemctl list-units --state=failed
systemctl list-unit-files
systemctl list-timers

# /etc/systemd/system/myapp.service
[Unit]
Description=My App
After=network-online.target postgresql.service
Wants=network-online.target
Requires=postgresql.service

[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp
EnvironmentFile=/etc/myapp/env
ExecStart=/opt/myapp/venv/bin/gunicorn config.wsgi
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now myapp

no
on-success
on-failure
on-abnormal
on-watchdog
on-abort
always

Environment="VAR=value"
EnvironmentFile=/etc/myapp/env
EnvironmentFile=-/etc/myapp/env.optional    # - means optional

systemctl edit nginx              # creates override.conf

# /etc/systemd/system/nginx.service.d/override.conf
[Service]
LimitNOFILE=65536

systemctl daemon-reload
systemctl restart nginx

journalctl                                # all
journalctl -u nginx
journalctl -u nginx -f                    # follow
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx --since "2026-01-01" --until "2026-01-02"
journalctl -p err                         # priority
journalctl -k                             # kernel
journalctl --boot                         # this boot
journalctl --list-boots
journalctl --boot -1                      # previous boot
journalctl -o json
journalctl -o cat                         # just messages
journalctl --disk-usage

journalctl --vacuum-size=500M
journalctl --vacuum-time=7d

SystemMaxUse=500M
MaxRetentionSec=1month

# /etc/systemd/system/backup.timer
[Unit]
Description=Daily backup

[Timer]
OnCalendar=daily
OnCalendar=*-*-* 02:00:00
Persistent=true                  # run if missed
RandomizedDelaySec=600

[Install]
WantedBy=timers.target

# /etc/systemd/system/backup.service
[Unit]
Description=Backup job

[Service]
Type=oneshot
ExecStart=/opt/backup.sh

systemctl enable --now backup.timer
systemctl list-timers

*-*-* 04:30:00              # daily 04:30
Mon..Fri *-*-* 09:00:00     # weekdays 09:00
*-*-1 03:00:00              # first of month
hourly, daily, weekly, monthly, yearly

systemctl get-default
systemctl set-default multi-user.target
systemctl isolate rescue.target

[Service]
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service

[Service]
MemoryMax=512M
MemoryHigh=400M
CPUQuota=50%
TasksMax=100
LimitNOFILE=65536

journalctl -u myapp -f
journalctl _SYSTEMD_UNIT=myapp.service
journalctl -p err -u myapp

[Service]
ExecStart=/home/me/bin/myapp

[Install]
WantedBy=default.target

systemctl --user enable --now myapp
loginctl enable-linger              # services survive logout

# foo.path
[Path]
PathChanged=/var/spool/incoming
Unit=foo.service

[Install]
WantedBy=multi-user.target

systemctl daemon-reload

systemd-analyze blame                 # what slow at boot
systemd-analyze critical-chain
systemd-analyze plot > boot.svg
systemd-analyze verify myapp.service
systemd-analyze security myapp

# foo.socket
[Socket]
ListenStream=8080
Accept=no

[Install]
WantedBy=sockets.target