🔧 Lesson 6.3: Services and systemctl

What Are Services?

A service (also called a daemon) is a program that runs in the background — no terminal window, no user interaction. Services start when your computer boots and keep running silently, handling essential tasks.

Common examples:

• ssh (sshd) — listens for incoming SSH connections
• apache2 / nginx — web servers
• NetworkManager — manages your network connections
• cron — runs scheduled tasks
• cups — manages printers
• ufw — the firewall

systemd — The Service Manager

systemd is the init system and service manager used by Ubuntu (and most modern Linux distros). It's the very first process that runs (PID 1) and manages all other services.

You interact with systemd through the systemctl command (system control). The basic pattern is always:

sudo systemctl [action] [service-name]

Checking Service Status

# Full status report for a service
sudo systemctl status ssh

# Quick check — is it running?
systemctl is-active ssh

# Quick check — is it enabled at boot?
systemctl is-enabled ssh

● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-04-14 09:00:15 PDT; 5h ago
       Docs: man:sshd(8)
   Main PID: 892 (sshd)
      Tasks: 1 (limit: 18845)
     Memory: 5.3M
        CPU: 85ms
     CGroup: /system.slice/ssh.service
             └─892 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

Apr 14 09:00:15 ray-desktop systemd[1]: Started OpenBSD Secure Shell server.

Key things to look at:

• Active — active (running) means it's working; inactive (dead) means it's stopped; failed means something went wrong
• Loaded — shows the unit file path and whether it's enabled (starts at boot) or disabled
• Main PID — the process ID of the service
• Log lines — the most recent log entries at the bottom

Starting, Stopping, and Restarting

# Start a stopped service
sudo systemctl start ssh

# Stop a running service
sudo systemctl stop ssh

# Restart a service (stop + start)
sudo systemctl restart ssh

# Reload configuration without fully restarting
# (only works if the service supports it)
sudo systemctl reload ssh

# Reload if supported, otherwise restart
sudo systemctl reload-or-restart ssh

Enable and Disable at Boot

Starting a service makes it run now. Enabling a service makes it start automatically on every boot. These are separate actions.

# Enable a service to start at boot
sudo systemctl enable ssh

# Disable a service from starting at boot
sudo systemctl disable ssh

# Enable AND start immediately (convenient combo)
sudo systemctl enable --now ssh

# Disable AND stop immediately
sudo systemctl disable --now ssh

# Prevent a service from being started at all (even manually)
sudo systemctl mask ssh

# Undo a mask
sudo systemctl unmask ssh

Listing All Services

# List all loaded services and their states
systemctl list-units --type=service

# List ALL services (including inactive/disabled)
systemctl list-units --type=service --all

# List only running services
systemctl list-units --type=service --state=running

# List only failed services (great for troubleshooting!)
systemctl list-units --type=service --state=failed

# List enabled services (those that start at boot)
systemctl list-unit-files --type=service --state=enabled

# Count running services
systemctl list-units --type=service --state=running --no-pager | grep -c ".service"

Viewing Service Logs

systemd captures log output from every service through journalctl. No more hunting through random log files in /var/log/.

# View logs for a specific service
journalctl -u ssh.service

# Show only the most recent entries
journalctl -u ssh.service -n 50

# Follow logs in real time (like tail -f)
journalctl -u ssh.service -f

# Show logs since a specific time
journalctl -u ssh.service --since "2026-04-14 09:00"
journalctl -u ssh.service --since "1 hour ago"

# Show only error messages
journalctl -u ssh.service -p err

# Show logs from the current boot
journalctl -u ssh.service -b

# How much disk space are logs using?
journalctl --disk-usage

# Clean old logs (keep only last 7 days)
sudo journalctl --vacuum-time=7d

Creating a Custom Service

You can turn any script or program into a managed service. Here's a simple example:

Step 1: Create a Script

# Create a simple script
sudo nano /usr/local/bin/hello-service.sh

#!/bin/bash
# A simple service that logs a message every 30 seconds
while true; do
    echo "Hello from my custom service! $(date)"
    sleep 30
done

# Make it executable
sudo chmod +x /usr/local/bin/hello-service.sh

Step 2: Create a Unit File

sudo nano /etc/systemd/system/hello.service

[Unit]
Description=Hello World Demo Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/hello-service.sh
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

Step 3: Load, Start, and Enable

# Tell systemd about the new unit file
sudo systemctl daemon-reload

# Start the service
sudo systemctl start hello.service

# Check it's running
sudo systemctl status hello.service

# View its logs
journalctl -u hello.service -f

# Enable it to start at boot (optional)
sudo systemctl enable hello.service

# When done experimenting, stop and clean up:
sudo systemctl stop hello.service
sudo systemctl disable hello.service
sudo rm /etc/systemd/system/hello.service
sudo rm /usr/local/bin/hello-service.sh
sudo systemctl daemon-reload

Exercises

# Check status
sudo systemctl status cron

# Stop it
sudo systemctl stop cron

# Verify it stopped
systemctl is-active cron

# Start it back up
sudo systemctl start cron

# Restart it (stop + start in one command)
sudo systemctl restart cron

# Verify it's running
sudo systemctl status cron

Knowledge Check

Summary

🚀 What's Next?

Module 7 takes you into Networking and SSH — connecting to other machines, transferring files, and securing remote access.