systemctl starts, stops and enables the services systemd runs, which it calls units. journalctl reads the journal, where systemd keeps the output and log messages of every unit. This sheet covers both. The examples use nginx as the service and a failing report.service as the broken one. Every command below was run on Debian 13 with systemd 257 in a virtual machine, and the output shown is from that machine. Flags are from the systemd 257 man pages on freedesktop.org.
what it is and when to use it
- Unit: anything systemd manages, named with a type suffix:
nginx.service,fstrim.timer,multi-user.target. Leave off.serviceand systemctl assumes it. - Service: a unit that runs a process. Timer: a unit that starts another unit on a schedule.
- Enabled: linked to start at boot. Masked: linked to
/dev/null, so nothing can start it. - Journal: systemd’s log store.
journalctl -ureads one unit’s entries out of it.
Reach for it on any Linux system that boots with systemd, which includes Debian, Ubuntu, Fedora and Arch. Changing units needs root, so those commands start with sudo.
install and check the version
There’s nothing to install: if the machine boots with systemd, both commands are already there. Check the version:
| Command | What it does |
|---|---|
systemctl --versionoutput systemd 257 (257.13-1~deb13u1) | systemd version (the first line is enough) |
start, stop, status
| Command | What it does |
|---|---|
systemctl status nginx | State, main PID, memory and the last log lines |
sudo systemctl start nginx sudo systemctl stop nginx sudo systemctl restart nginx | Start, stop or restart now. Doesn’t change what happens at boot |
sudo systemctl reload nginx | Reread config without stopping, for services that support it |
sudo systemctl reload-or-restart nginx | Reload if the service supports it, restart if not |
systemctl is-active nginx systemctl is-failed report | For scripts: test the exit status (0 means yes) or add -q. The printed word is the real state, such as activating |
enable, disable, mask
| Command | What it does |
|---|---|
sudo systemctl enable --now nginx | Start at boot, and start now as well |
sudo systemctl disable --now nginx | Stop starting at boot, and stop now as well |
systemctl is-enabled nginx | Enabled, disabled, static or masked |
sudo systemctl mask nginx | Block every start, by hand or by another unit, until unmasked |
sudo systemctl unmask nginx | Undo the mask |
A start on a masked unit fails with Unit nginx.service is masked.
list units
| Command | What it does |
|---|---|
systemctl --failed systemctl list-units --state=failed | Units that failed, and the same as a list-units filter |
systemctl list-units --type=service --state=running | Services running right now |
systemctl list-unit-files --type=service --state=enabled | Services enabled at boot |
systemctl list-timers | Timers, with when each one runs next and last |
sudo systemctl reset-failed report | Clear a unit’s failed state once you’ve dealt with it |
read and change unit files
| Command | What it does |
|---|---|
systemctl cat nginx | The unit file and any drop-ins, with the path of each |
systemctl show nginx -p MainPID -p ActiveState -p NRestarts | Chosen properties, one per line |
sudo systemctl edit nginx sudo systemctl restart nginx | Override settings in a drop-in file. systemd reloads the unit files when you close the editor, but the service keeps its old settings until you restart it |
sudo systemctl revert nginx | Remove your drop-ins and go back to the packaged unit |
sudo systemctl daemon-reload | Reload unit files after editing them by hand |
systemctl edit saves to /etc/systemd/system/nginx.service.d/override.conf. Put the section header in it, for example [Service] above Restart=on-failure.
the journal by unit
| Command | What it does |
|---|---|
journalctl -u reportoutput report.sh[4518]: report: starting report.sh[4518]: report: cannot open /srv/data.csv | Everything one unit logged, oldest first |
Those are two of the six lines, with the date, time and host name trimmed from the front. The other four are systemd starting the unit and reporting the failure.
| Command | What it does |
|---|---|
journalctl -u nginx -n 50 -f | The last 50 lines, then keep following new ones (Ctrl-C to stop) |
journalctl -u report -g 'cannot open' | Only entries whose message matches a pattern. An all-lowercase pattern ignores case |
by boot or time
| Command | What it does |
|---|---|
journalctl --list-boots | Boots the journal knows about. 0 is this one, -1 the one before |
journalctl -b journalctl -b -1 | This boot, or the previous one |
journalctl -b -p err | Errors and worse from this boot |
journalctl -k -b | Kernel messages from this boot, like dmesg |
journalctl -u report --since "2026-10-28 09:55" --until "2026-10-28 09:57" | A time window. Also takes "yesterday", "today" and "1 hour ago" |
journalctl -u report --since today -o short-iso | Full timestamps with the year and time zone offset |
journal disk use
| Command | What it does |
|---|---|
journalctl --disk-usage | Space used by active and archived journal files |
On the test machine that printed Archived and active journals take up 8M in the file system.
| Command | What it does |
|---|---|
sudo journalctl --vacuum-size=100M | Delete the oldest archived files until they use less than 100M |
sudo journalctl --vacuum-time=2weeks | Delete archived files older than two weeks |
To cap it for good, set SystemMaxUse= in /etc/systemd/journald.conf. The default is 10% of the file system, capped at 4G.
gotchas
maskdoesn’t stop a running service. It only blocks the next start. Stop it as well if that’s what you want.maskleaves the enable links in place, andunmaskonly removes the/dev/nulllink. A unit that was enabled before you masked it starts at boot again afterunmask.- After editing a unit file by hand, systemctl warns that it "changed on disk" until you run
sudo systemctl daemon-reload.systemctl editreloads for you when you close the editor. Neither one restarts the service. - Without a terminal,
systemctl editfails with "Cannot edit units interactively if not on a tty." systemd 257 can read the drop-in from a pipe withsystemctl edit --stdin(from the man page, not run in our test). - Without root, or membership of the
systemd-journaloradmgroup (orwheel, on distributions that have one),journalctlshows only your own messages and prints a hint saying so. --vacuum-sizeand--vacuum-timeonly delete archived files.--disk-usagecounts the active ones too, so it may not drop as far as you asked.journalctl -b -1needs a persistent journal in/var/log/journal. Debian 13 has one. If yours only logs to/run/log/journal, earlier boots are gone.
related on terminal-life
sources
Checked against the systemd 257 man pages on freedesktop.org. Tested on systemd 257 (257.13-1~deb13u1) on Debian 13, in a virtual machine that was deleted afterwards.
What ran:
status,start,stop,restart,reload,reload-or-restart,is-active,is-failed,is-enabled.enable --now,disable --now,mask,unmask, including a start on a masked unit.--failed,list-units,list-unit-files,list-timers,reset-failed.cat,show -p,edit(under a terminal),revert,daemon-reload.journalctlwith-u,-n,-f,-g,--list-boots,-b,-b -1after a reboot,-p err,-k,--since,--until,-o short-iso,--disk-usage,--vacuum-sizeand--vacuum-time.
Sources:
Full source links: terminal-life.com/cheatsheets/systemd/#sources
terminal-life.com/cheatsheets/systemd/ · tested on systemd 257 (Debian 13)