Cheat sheet

Services and logs (systemd)

Starting, stopping and fixing services with systemctl, and finding out what went wrong with journalctl.

Nothing you type here is sent. Nothing is saved, unless you switch on Remember. Privacy policy

For any Linux that uses systemd, which is nearly all of them now. "Since" takes plain English like yesterday, 10 min ago or a date like 2026-11-05 09:00. Reading other services' logs needs sudo, or membership of the systemd-journal group (adm on Debian and Ubuntu).

Services

systemctl status nginx

Is it running, since when, and its last few log lines. Start here.

sudo systemctl restart nginx

Stop it and start it again.

sudo systemctl reload nginx

Re-read its config without stopping it, for services that support it (nginx does). No dropped connections.

sudo systemctl enable --now nginx

Start it now, and at every boot.

--now: start it as well, not just at the next boot

sudo systemctl disable --now nginx

Stop it now, and don't start it at boot.

sudo systemctl mask nginx

Make it impossible to start, even by something that depends on it. unmask undoes it.

systemctl is-active nginx

Just "active" or not. Handy in scripts.

systemctl --failed

Everything that has failed. Worth a look after a reboot.

systemctl list-units --type=service --state=running

Every service that's running.

Changing a service

systemctl cat nginx

The service's unit file, plus any overrides, exactly as systemd sees them.

sudo systemctl edit nginx

Add your own settings in an override file, so a package update can't overwrite them.

sudo systemctl daemon-reload

Make systemd notice unit files you've changed by hand. Then restart the service.

systemctl list-dependencies nginx

What the service needs before it can start.

Logs

journalctl -u nginx -e

A service's logs, starting at the end.

-u: this service only
-e: jump to the end

journalctl -u nginx -f

Watch a service's logs live. Ctrl+C stops.

journalctl -u nginx --since '1 hour ago'

A service's logs from a point in time.

journalctl -u nginx -n 100 --no-pager

The last 100 lines, printed straight out. Good for pasting into a ticket.

journalctl -b -p err

Every error since the last boot, from anything.

-b: this boot only
-p err: errors and worse

journalctl -b -1 -e

The end of the previous boot. Where to look after a crash (if the journal is kept on disk).

journalctl -k

Messages from the kernel: disks, network cards, out-of-memory kills.

journalctl --disk-usage

How much space the logs are taking.

sudo journalctl --vacuum-time=2weeks

Throw away logs older than two weeks.

Timers (systemd's cron)

systemctl list-timers

Every scheduled job, when it last ran and when it runs next.

sudo systemd-run --on-active=30m touch /tmp/done

Run a one-off command in 30 minutes, without writing a timer file.

The machine itself

systemd-analyze blame

What made the last boot slow, slowest first.

hostnamectl

The machine's name, OS and kernel at a glance.

timedatectl

The time, the timezone, and whether the clock is syncing.

sudo timedatectl set-timezone Pacific/Auckland

Set the timezone (timedatectl list-timezones for the rest of the world).

sudo systemctl reboot

Restart the machine.