The systemctl command may be used to introspect and control the state of the "systemd" system and service manager. Please refer to systemd(1) for an introduction into the basic concepts and functionality this tool manages.
| Command | Use |
|---|---|
systemctl start sshd |
Starts the sshd daemon (ssh server) |
systemctl stop sshd |
Stops the sshd daemon. If still enabled, this will mean that it will restart when a reboot occurs |
systemctl enable sshd |
This will set the sshd daemon to start on boot, but does not start it immediately |
systemctl enable --now sshd |
Enables the sshd service to start automatically on boot and immediately starts it. This command combines two actions:
|
systemctl status |
Displays the overall system status, including information about active and inactive units (services, sockets, targets, etc.). This command provides a summary of the current state of the system's services and their associated processes. |
systemctl list-unit-files --state=enabled |
Lists all enabled unit files in the system, including services, sockets, and targets. This command provides a comprehensive overview of the units that are set to start automatically during system boot. |
systemctl set-default multi-user.target |
Sets the default boot to CLI |
systemctl isolate multi-user.target |
Switches immediately to CLI mode only |
/var/log/journaljournalctl --disk-usageSystemMaxUse setting in /etc/systemd/jourald.conf e.g. SystemMaxUse=100M to set to 100 megabytesRequires the journald service to be restarted
systemctl restart systemd-journald.service to restart| Command | Explanation |
|---|---|
journalctl --disk-usage |
Check how much storage journalctl is consuming |
journalctl -f |
Follow the log, akin to tail -f |
journalctl --list-boot |
Lists the journal logs from previous boots |
journalctl -b [BOOT INDEX] |
Display journalctl log from BOOT INDEX. If nothing specified, then it will display current boot |
journalctl -p <PRIORITY> |
Filter journalctl output depending on priority. These are (in ascending order) as follows: debug, info, notice, warning, err, crit, alert, emerg |
journalctl -u sshd.service |
Filter based on systemd unit (sshd in this example) |
journalctl --since <YYYY-MM-DD hh:mm:ss>journalctl --until <YYYY-MM-DD hh:mm:ss> |
Filter logs based on dates. yesterday, today, and tomorrow are acceptable. "-1 hour" will show the events over the last 60 minutes |
journalctl -o verbose |
Adds verbosity to the output. See table below for some guidance on the output |
journalctl --flush |
Flushes logs in volitile storage (/run) to persistent storage (/var) |
Sun 2025-03-02 22:35:46.459502 GMT [s=1cb969874dd742c18fd4913d...
PRIORITY=6
SYSLOG_FACILITY=3
TID=576
CODE_FILE=src/core/main.c
CODE_LINE=2276
CODE_FUNC=do_queue_default_job
SYSLOG_IDENTIFIER=systemd
MESSAGE=Queued start job for default target default.target.
_BOOT_ID=69a8c0996e2a47f4baa9bf3a9f8eb9a0
_MACHINE_ID=22f8b50a476c45b887f3514418308c11
_HOSTNAME=podmantestground
_RUNTIME_SCOPE=system
| Field | Meaning |
|---|---|
_COMM |
The command name |
_EXE |
The path to the executable file for the process |
_PID |
The PID of the process |
_UID |
The UID of the user that runs the process |
_SYSTEMD_UNIT |
The systemd unit that started the process |
Syslog is standalone from journald. Journald is designed to be compatible with syslog.
| Code | Facility | Facility description |
|---|---|---|
| 0 | kern | Kernel messages |
| 1 | user | User-level messages |
| 2 | Mail system messages | |
| 3 | daemon | System daemon messages |
| 4 | auth | Authentication and security messages |
| 5 | syslog | Internal syslog messages |
| 6 | lpr | Printer messages |
| 7 | news | Network news messages |
| 8 | uucp | UUCP protocol messages |
| 9 | cron | Clock daemon messages |
| 10 | authpriv | Nonsystem authorization messages |
| 11 | ftp | FTP protocol messages |
| 16-23 | local0 to local7 | Custom local messages |
Syslog has the following priorities (0 being the highest).
| Code | Priority | Priority description |
|---|---|---|
| 0 | emerg | System is unusable |
| 1 | alert | Action must be taken immediately |
| 2 | crit | Critical condition |
| 3 | err | Noncritical error condition |
| 4 | warning | Warning condition |
| 5 | notice | Normal but significant event |
| 6 | info | Informational event |
| 7 | debug | Debugging-level message |