Systemd Cheatsheet

Q: What's the difference between systemctl and journalctl?

systemctl manages system services, units, and overall system state (start, stop, enable, disable services, etc.). journalctl is dedicated to viewing logs collected by systemd-journald. In short: systemctl manages services, journalctl views logs.

Q: What's the difference between systemd timers and cron?

Systemd timers are more powerful than cron: they support monotonic time (relative to an event), calendar time (cron-like), random delays, dependencies on other systemd units, and comprehensive logging. The downside is more complex syntax. For new projects, consider systemd timers.

Q: How do I investigate a service startup failure?

1) Run `systemctl status service-name` to see recent logs. 2) Use `journalctl -u service-name -xe` for more context. 3) Use `journalctl -u service-name --since today` to see today's logs. 4) Check `systemctl list-dependencies service-name` for dependency chain issues.

Q: How do I create a custom systemd service?

Create a .service file in /etc/systemd/system/ with [Unit], [Service], and [Install] sections. Then run `systemctl daemon-reload` to reload, `systemctl enable name.service` to enable auto-start, and `systemctl start name.service` to start it.

systemd is the de facto standard init system and service manager on modern Linux. This cheatsheet organizes essential systemd commands by category — service control, timers, journald logs, unit management, boot analysis, and socket activation — each with practical examples.

Updated: 2026-07-16·40 commands

Quick Reference

Task

Command

Start a service	`systemctl start nginx`
Check service status	`systemctl status nginx`
Follow logs in real-time	`journalctl -u nginx -f`
Schedule recurring jobs	`systemd timer unit`
Analyze boot speed	`systemd-analyze blame`
View active sockets	`systemctl list-sockets`

Service Management

``bash # Start / Stop / Restart / Reload systemctl start nginx.service # Start service (.service can be omitted) systemctl stop nginx # Stop service systemctl restart nginx # Restart service systemctl reload nginx # Reload config (no service interruption) systemctl reload-or-restart nginx # Reload if supported, else restart

# Enable / Disable (auto-start on boot) systemctl enable nginx # Enable auto-start at boot systemctl enable --now nginx # Enable and start immediately systemctl disable nginx # Disable auto-start systemctl disable --now nginx # Disable and stop immediately

# Check service status systemctl status nginx # Detailed status (with recent logs) systemctl is-active nginx # Check if running (active/inactive) systemctl is-enabled nginx # Check if enabled (enabled/disabled) systemctl is-failed nginx # Check if failed

# mask / unmask (complete lockdown) systemctl mask nginx # Mask service (cannot be started manually) systemctl unmask nginx # Unmask service`

`Timer Management`

`bash # List timers systemctl list-timers # List all timers (with next trigger time) systemctl list-timers --all # List all (including expired) systemctl status myapp.timer # View timer status

# Timer operations systemctl start myapp.timer # Start timer systemctl enable myapp.timer # Enable timer auto-start systemctl stop myapp.timer # Stop timer systemctl disable myapp.timer # Disable timer

# Manually trigger a timer service systemctl start myapp.service # Manually trigger associated service

# View timer logs journalctl -u myapp.timer # View timer logs journalctl -u myapp.service # View service execution logs`

`Journal Logs`

`bash # Basic viewing journalctl # View all logs (less pager) journalctl -n 50 # View last 50 log entries journalctl -f # Follow new log entries (like tail -f) journalctl -e # Jump to end of log

# Filter by service journalctl -u nginx # View logs for a specific service journalctl -u nginx -u sshd # View logs for multiple services journalctl -u nginx -f # Follow logs for a specific service

# Filter by time journalctl --since today # View logs since today journalctl --since "2026-07-15" # From a specific date journalctl --until "1 hour ago" # Up to one hour ago journalctl --since "2026-07-15 09:00" --until "2026-07-15 18:00"

# Filter by priority journalctl -p err # Show only error level and above journalctl -p warning # Warning and above journalctl -p err -u nginx # Combined filtering

# Output formats journalctl -o json # JSON format output journalctl -o verbose # Verbose (all fields) journalctl -o short-monotonic # Monotonic timestamp format

# Disk management journalctl --disk-usage # Check journal disk usage journalctl --vacuum-size=500M # Keep only last 500M of logs journalctl --vacuum-time=30d # Keep only last 30 days of logs`

`Unit Management`

`bash # List units systemctl list-units # List all active units systemctl list-units --type=service # List all service units systemctl list-units --type=timer # List all timer units systemctl list-units --type=socket # List all socket units systemctl list-units --state=running # List running units systemctl list-unit-files # List all unit files with enable status

# Unit operations systemctl cat nginx.service # View unit file contents systemctl show nginx.service # View detailed unit properties systemctl list-dependencies nginx # View unit dependencies systemctl help nginx.service # View unit's man page

# System state systemctl daemon-reload # Reload unit files (required after changes) systemctl reset-failed nginx # Clear failed state systemctl is-system-running # Check system state (running/degraded)

# Edit unit files systemctl edit nginx.service # Create drop-in override systemctl edit --full nginx.service # Edit full unit file

# Mask / unmask systemctl mask nginx.service # Mask unit (cannot be started) systemctl unmask nginx.service # Unmask unit`

`Boot Analysis`

`bash # Boot time analysis systemd-analyze # View total boot time systemd-analyze time # Same (detailed) systemd-analyze blame # Sort services by init time (find the slowest) systemd-analyze critical-chain # Show critical boot chain systemd-analyze plot > boot.svg # Generate boot timeline SVG

# Dependency analysis systemd-analyze dot nginx.service # Generate dependency graph (DOT format) systemd-analyze dot | dot -Tsvg > deps.svg # Generate dependency SVG

# Security audit systemd-analyze security # Security score for all services systemd-analyze security nginx.service # Security score for a specific service

# Environment checks systemd-analyze verify /etc/systemd/system/myapp.service # Validate unit file systemd-analyze condition 'ConditionPathExists=/etc/nginx' # Test conditions

# SysV compatibility systemd-analyze sysv-chkconfig # List SysV-compatible services`

`Socket Activation`

`bash # List socket units systemctl list-sockets # List all sockets and their associated services systemctl list-units --type=socket # List all socket units

# Socket operations systemctl start myapp.socket # Start socket listener systemctl enable myapp.socket # Enable socket auto-start systemctl status myapp.socket # View socket status

# Socket configuration info systemctl show myapp.socket # View socket configuration details ss -tlnp | grep myapp # View actual listening ports

# Check listening status systemctl is-active myapp.socket # Check if socket is listening journalctl -u myapp.socket # View socket-related logs``

Service Mgmt(10)

Command	Level	Example
`systemctl start` Start a service	Basic	`systemctl start nginx.service`
`systemctl stop` Stop a service	Basic	`systemctl stop nginx`
`systemctl restart` Restart a service	Basic	`systemctl restart nginx`
`systemctl reload` Reload service configuration (zero-downtime)	Intermediate	`systemctl reload nginx`
`systemctl enable` Enable service to auto-start at boot	Basic	`systemctl enable nginx`
`systemctl disable` Disable service auto-start at boot	Basic	`systemctl disable nginx`
`systemctl enable --now` Enable and start service immediately	Basic	`systemctl enable --now nginx`
`systemctl status` View detailed service status (with recent logs)	Basic	`systemctl status nginx`
`systemctl is-active / is-enabled / is-failed` Check service running/enabled/failed status	Intermediate	`systemctl is-active nginx`
`systemctl mask / unmask` Mask/unmask a service (completely prevent startup)	Expert	`systemctl mask nginx`

Timer(4)

Command	Level	Example
`systemctl list-timers` List all timers with next trigger times	Basic	`systemctl list-timers --all`
`systemctl start myapp.timer` Start a timer	Basic	`systemctl start myapp.timer`
`systemctl enable myapp.timer` Enable timer auto-start at boot	Basic	`systemctl enable myapp.timer`
`journalctl -u myapp.timer` View timer-related logs	Intermediate	`journalctl -u myapp.timer`

Journal(8)

Command	Level	Example
`journalctl` View all system logs (less pager)	Basic	`journalctl -n 50`
`journalctl -f` Follow logs in real-time (like tail -f)	Basic	`journalctl -f`
`journalctl -u` Filter logs by service unit	Basic	`journalctl -u nginx -u sshd`
`journalctl --since / --until` Filter logs by time range	Intermediate	`journalctl --since today --until "1 hour ago"`
`journalctl -p` Filter logs by priority level	Intermediate	`journalctl -p err -u nginx`
`journalctl -o json` Output logs in JSON format	Intermediate	`journalctl -o json`
`journalctl --disk-usage` Check log disk usage	Intermediate	`journalctl --disk-usage`
`journalctl --vacuum-size / --vacuum-time` Limit log disk usage or retention time	Expert	`journalctl --vacuum-size=500M`

Units(7)

Command	Level	Example
`systemctl list-units` List all active units	Basic	`systemctl list-units --type=service --state=running`
`systemctl list-unit-files` List all unit files with their enable status	Basic	`systemctl list-unit-files`
`systemctl cat` View unit file contents	Intermediate	`systemctl cat nginx.service`
`systemctl show` View detailed unit properties	Intermediate	`systemctl show nginx.service`
`systemctl list-dependencies` View unit dependency chain	Intermediate	`systemctl list-dependencies nginx`
`systemctl daemon-reload` Reload unit files (required after modifications)	Basic	`systemctl daemon-reload`
`systemctl edit` Edit unit file (create drop-in override)	Expert	`systemctl edit nginx.service`

Boot(6)

Command	Level	Example
`systemd-analyze time` View total system boot time	Basic	`systemd-analyze time`
`systemd-analyze blame` Show services sorted by init time (find slowest)	Intermediate	`systemd-analyze blame`
`systemd-analyze critical-chain` Show critical boot chain (bottleneck analysis)	Intermediate	`systemd-analyze critical-chain`
`systemd-analyze plot` Generate boot timeline graph (SVG format)	Intermediate	`systemd-analyze plot > boot.svg`
`systemd-analyze security` Audit service security scores	Expert	`systemd-analyze security nginx.service`
`systemd-analyze verify` Validate unit file syntax	Expert	`systemd-analyze verify /etc/systemd/system/myapp.service`

Socket Activation(5)

Command	Level	Example
`systemctl list-sockets` List all socket listeners and their associated services	Basic	`systemctl list-sockets`
`systemctl start myapp.socket` Start socket listener	Intermediate	`systemctl start myapp.socket`
`systemctl enable myapp.socket` Enable socket auto-start at boot	Intermediate	`systemctl enable myapp.socket`
`systemctl show myapp.socket` View socket configuration details	Intermediate	`systemctl show myapp.socket`
`systemctl is-active myapp.socket` Check if socket is actively listening	Intermediate	`systemctl is-active myapp.socket`

FAQ

What's the difference between systemctl and journalctl?

What's the difference between systemd timers and cron?

How do I investigate a service startup failure?

How do I create a custom systemd service?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-16.