Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · process & service management

systemctl

running the services

systemctl is how services are managed on a systemd machine. It keeps two things apart that are easy to confuse: whether a service is running now, and whether it will be started at boot. start and stop change the first; enable and disable change the second.

"Active" is about this moment; "enabled" is about the next boot. A service can be either without the other.

Controls
systemd units
services, timers, mounts
Needs root
To change
status is unprivileged
Now
start / stop
restart, reload
At boot
enable / disable
--now does both

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashsystemd
$ systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
1 Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
2 Active: active (running) since Mon 2026-09-28 09:40:12 IST; 2 days ago
3 Main PID: 1042 (nginx)
Tasks: 2 (limit: 4601)
Memory: 6.8M
4 CGroup: /system.slice/nginx.service
├─1042 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
└─1043 "nginx: worker process"
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
Loaded: where the unit is and whether it starts at boot

The path is the unit file systemd read. "enabled" means it will be started automatically on the next boot.

2
Active: what is true right now

Running, and for how long. A service that crashed reads "failed" here, with the exit code beside it.

3
Main PID is the process systemd watches

If this process exits, systemd considers the service stopped and applies its restart policy.

4
The control group is the whole service

Every process the service started is listed, so nothing is left behind when it is stopped.

Switches

A switch changes how the command behaves. These are the ones used day to day; man systemctl lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

--now
With enable or disable, also start or stop the service immediately.
--failed
List only the units that have failed.
-t TYPE
Limit a listing to one unit type, for example -t service.
-a
All: include units that are loaded but inactive.
--user
Talk to your own user’s service manager instead of the system’s.
--no-pager
Print straight to the terminal instead of opening a pager.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo systemctl restart nginx

Stops and starts the service. "reload" re-reads the configuration without dropping connections, where the service supports it.

sudo systemctl enable --now nginx

Starts it now and sets it to start at every boot, in one step.

systemctl --failed

Lists every unit that is in a failed state — the first thing to check after a reboot.

journalctl -u nginx -n 50

The last fifty log lines the service wrote — where the reason for a failure usually is.

In cybersecurity

Every enabled service is code that starts by itself and keeps running. The list of them is the machine's standing attack surface.

Disable what you do not use

A stopped service comes back at reboot unless it is also disabled. "systemctl list-unit-files --state=enabled" is the list to prune.

Persistence

A new unit file is a favourite way for an intruder to survive a reboot. Unfamiliar entries under /etc/systemd/system deserve a close look.

Run as less than root

A unit can set User=, and sandboxing options such as ProtectSystem= and NoNewPrivileges= limit what a compromised service can reach.

Filed under

Process & service management

Read alongside

psTakes a snapshot of the running processes — who owns each, its process ID, and how much CPU and memory it is using.sudoRuns a single command as root, or as another user, after checking the caller is permitted to — and logs that it happened.