Cheat sheet

systemd

systemctl, journalctl, unit files, timers, targets, and overrides.

systemctl basics

# Start / stop / restart a service
systemctl start nginx
systemctl stop nginx
systemctl restart nginx

# Reload config without restart
systemctl reload nginx

# Enable / disable at boot
systemctl enable nginx
systemctl disable nginx

# Enable and start in one step
systemctl enable --now nginx

# Check service status
systemctl status nginx

# Check if active / enabled
systemctl is-active nginx
systemctl is-enabled nginx

# List all failed units
systemctl --failed

journalctl

# All logs for a service
journalctl -u nginx

# Follow live logs
journalctl -u nginx -f

# Last 100 lines
journalctl -u nginx -n 100

# Logs since last boot
journalctl -u nginx -b

# Logs in time range
journalctl -u nginx \
  --since "2026-05-01 00:00:00" \
  --until "2026-05-01 12:00:00"

# Kernel messages
journalctl -k

# Priority filter (err, warning, info, debug)
journalctl -u nginx -p err

# Output as JSON
journalctl -u nginx -o json | jq '.'

# Disk usage of journal
journalctl --disk-usage

Service unit file

# /etc/systemd/system/my-app.service

[Unit]
Description=My Application
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=myapp
WorkingDirectory=/opt/my-app
ExecStart=/opt/my-app/bin/server --port 8080
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
StandardOutput=journal
StandardError=journal
Environment=NODE_ENV=production
EnvironmentFile=/etc/my-app/env

[Install]
WantedBy=multi-user.target

Timer units (cron replacement)

# /etc/systemd/system/cleanup.timer

[Unit]
Description=Run cleanup daily

[Timer]
OnCalendar=daily
RandomizedDelaySec=1h
Persistent=true

[Install]
WantedBy=timers.target

---
# /etc/systemd/system/cleanup.service

[Unit]
Description=Cleanup job

[Service]
Type=oneshot
ExecStart=/usr/local/bin/cleanup.sh

---
# Enable and start timer
systemctl enable --now cleanup.timer

# List all timers
systemctl list-timers

Targets & dependencies

# List all active targets
systemctl list-units --type=target

# Get default boot target
systemctl get-default

# Set default boot target
systemctl set-default multi-user.target

# Common targets:
# multi-user.target  — CLI, no GUI (default for servers)
# graphical.target   — multi-user + GUI
# rescue.target      — single user, minimal services
# network.target     — networking is up

# Show dependency tree for a unit
systemctl list-dependencies nginx

# Show reverse dependencies (what depends on it)
systemctl list-dependencies --reverse nginx

Reload & override

# Reload systemd after editing unit files
systemctl daemon-reload

# Edit a unit file (creates override)
systemctl edit nginx

# Edit the full unit file
systemctl edit --full nginx

# Show effective unit (with overrides applied)
systemctl cat nginx

# Revert override
systemctl revert nginx

# Mask a unit (prevent start)
systemctl mask nginx

# Unmask
systemctl unmask nginx

About the systemd cheat sheet

systemd is two tools in practice: systemctl for managing units and journalctl for reading what they did. Most day-to-day work is starting, stopping, enabling and inspecting services, and the distinction between starting and enabling catches people out — one affects now, the other affects boot.

Unit files should rarely be edited in place. Packages install units under the system directory, and your changes there will be overwritten on upgrade. Drop-in overrides let you change specific directives while inheriting the rest, and they survive package updates, which is why they are the correct way to customise a shipped unit.

journalctl is where the answers are, and its filters are what make it usable. Filtering by unit, by boot, by time window and by priority turns an unreadable firehose into the ten lines that matter. Following a specific unit's log while restarting it is the fastest way to diagnose a service that will not start.

Frequently asked questions

What is the difference between start and enable?

Start runs the service now and does nothing about boot. Enable creates the symlinks that make it start at boot and does nothing right now. Forgetting to enable is why a service works after manual intervention and disappears after a reboot — a failure mode that surfaces weeks later at the worst time.

How do I change a unit shipped by a package?

Use an override rather than editing the file. The edit subcommand creates a drop-in that layers on top of the packaged unit, so you change only the directives you care about and the rest survives upgrades. To clear a list-valued directive before setting it, assign it an empty value first, otherwise your entry is appended rather than replacing.

Why is my service failing to start with no useful error?

Read the journal for that specific unit rather than the status output, which truncates. Filtering by unit and following while you restart shows the full output including anything the process wrote before dying. Check the exit code too — systemd reports it, and it often identifies the failure faster than the logs do.

How do timers compare to cron?

Timers are units, so they get the same logging, dependency handling and resource control as services, and journalctl shows the run history. With `Persistent=true` they also run a missed job on the next boot, which plain cron does not. The cost is more configuration for a simple schedule — two files instead of one line.

How do I stop the journal filling the disk?

Set retention limits by size or time in the journald configuration, or vacuum existing logs down to a size or age. On a machine with persistent storage, an unbounded journal will eventually consume the disk. This is worth setting deliberately at build time rather than discovering under pressure.