systemd is a system and service manager for Linux, compatible with SysV and LSB init scripts. systemd provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups, supports snapshotting and restoring of the system state, maintains mount and automount points and implements an elaborate transactional dependency-based service control logic.

Basic systemctl usage

The main command used to introspect and control systemd is systemctl. Some of its uses are examining the system state and managing the system and services. See man 1 systemctl for more details.

Analyzing the system state

List running units:

$ systemctl or $ systemctl list-units

List failed units:

$ systemctl --failed

The available unit files can be seen in /usr/lib/systemd/system/ and /etc/systemd/system/ (the latter takes precedence). You can see a list of the installed unit files with: $ systemctl list-unit-files

Using units

Units can be, for example, services (.service), mount points (.mount), devices (.device) or sockets (.socket).

When using systemctl, you generally have to specify the complete name of the unit file, including its suffix, for example sshd.socket. There are however a few short forms when specifying the unit in the following systemctl commands:

If you do not specify the suffix, systemctl will assume .service. For example, netcfg and netcfg.service are equivalent.

Mount points will automatically be translated into the appropriate .mount unit. For example, specifying /home is equivalent to home.mount.

Similar to mount points, devices are automatically translated into the appropriate .device unit, therefore specifying /dev/sda2 is equivalent to dev-sda2.device.

See man systemd.unit for details.

Activate a unit immediately:

$ systemctl start unit

Deactivate a unit immediately:

$ systemctl stop unit

Restart a unit:

$ systemctl restart unit

Ask a unit to reload its configuration:

$ systemctl reload unit

Show the status of a unit, including whether it is running or not:

$ systemctl status unit

Check whether a unit is already enabled or not:

$ systemctl is-enabled unit

Enable a unit to be started on bootup:

$ systemctl enable unit

Disable a unit to not start during bootup:

$ systemctl disable unit

Show the manual page associated with a unit (this has to be supported by the unit file):

$ systemctl help unit

Reload systemd, scanning for new or changed units:

$ systemctl daemon-reload

Journal

systemd has its own logging system called the journal; therefore, running a syslog daemon is no longer required. To read the log, use:
$ journalctl

The directory /var/log/journal/ is a part of the systemd package, and the journal (when Storage= is set to auto in /etc/systemd/journald.conf) will write to /var/log/journal/. If you or some program delete that directory, systemd will not recreate it automatically; however, it will be recreated during the next update of the systemd package. Until then, logs will be written to /run/systemd/journal, and logs will be lost on reboot.

Tip: If /var/log/journal/ resides in a btrfs file system, you should consider disabling Copy-on-Write for the directory.

Filtering output

journalctl allows you to filter the output by specific fields. Be aware that if there are many messages to display or filtering of large time span has to be done, the output of this command can be delayed for quite some time.

Tip: While the journal is stored in a binary format, the content of stored messages is not modified. This means it is viewable with strings, for example for recovery in an environment which does not have systemd installed. Example command: $ strings /mnt/arch/var/log/journal/af49676ddd/system.journal | grep message

Examples

Show all messages from this boot:

$ journalctl -b

However, often one is interested in messages not from the current, but from the previous boot (e.g. if an unrecoverable system crash happened). This is possible through optional offset parameter of the -b flag: journalctl -b -0 shows messages from the current boot, journalctl -b -1 from the previous boot, journalctl -b -2 from the second previous and so on. See man 1 journalctl for full description.

Follow new messages:

$ journalctl -f

Show all messages by a specific executable:

$ journalctl /usr/lib/systemd/systemd

Show all messages by a specific process:

$ journalctl _PID=1

Show all messages by a specific unit:

$ journalctl -u netcfg

Show kernel ring buffer:

$ journalctl _TRANSPORT=kernel