systemd services and systemctl

What systemd does

A service (or daemon) is a program that runs in the background without a user, like the web server httpd or the SSH server sshd. systemd is the first process (PID 1). It starts services at boot in the right order, restarts them if they crash (when told to), collects their logs, and stops them cleanly at shutdown.

systemd manages units. A unit is anything systemd manages, described by a small text file. The type is the ending of its name:

Everyday systemctl

# systemctl status httpd
● httpd.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled)
     Active: inactive (dead)
# systemctl enable --now httpd       # start now AND at every boot
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
# systemctl is-active httpd
active
# systemctl is-enabled httpd
enabled
# systemctl restart httpd    # stop then start
# systemctl reload httpd     # re-read config without stopping (if the service supports it)
# systemctl stop httpd
# systemctl disable httpd    # do not start at boot

Two separate ideas trip people up. Active means running now. Enabled means it will start at boot. A service can be active but disabled (it will be gone after a reboot), or enabled but inactive (it failed, or you stopped it). In exams and in real work, most tasks need both: enable --now.

Listing units

$ systemctl list-units --type=service --state=running
$ systemctl list-units --failed
  UNIT          LOAD   ACTIVE SUB    DESCRIPTION
● kdump.service loaded failed failed Crash recovery kernel arming
$ systemctl list-unit-files --type=service | grep enabled
$ systemctl cat sshd       # show the unit file
$ systemctl list-dependencies multi-user.target

Unit files and where they live

Packages install unit files in /usr/lib/systemd/system/. Your own units and changes go in /etc/systemd/system/, which wins over /usr/lib. Do not edit files in /usr/lib directly; an update will overwrite them. Instead run systemctl edit name, which creates a small override ("drop-in") file. After changing any unit file by hand, run systemctl daemon-reload so systemd reads it again.

# /etc/systemd/system/notes-api.service
[Unit]
Description=Notes API
After=network-online.target
Wants=network-online.target

[Service]
User=notes
ExecStart=/usr/bin/python3 /opt/notes/app.py
Restart=on-failure

[Install]
WantedBy=multi-user.target

mask: stronger than disable

disable only removes the boot-time link; another service or a person can still start it. mask links the unit to /dev/null so it cannot be started at all, by anyone, until unmask. Use it when two services conflict, for example to make sure iptables never runs alongside firewalld.

# systemctl mask iptables
Created symlink /etc/systemd/system/iptables.service → /dev/null.
# systemctl start iptables
Failed to start iptables.service: Unit iptables.service is masked.
# systemctl unmask iptables

Common mistakes

• Running only systemctl start in an exam task that says "the service must start at boot". The reboot check fails. Use enable --now.
• Editing a unit file and forgetting systemctl daemon-reload. systemd keeps using the old version and warns you in status.
• Reading "Active: failed" and immediately restarting. First read the log lines under status, or journalctl -u name, to see WHY.