systemd
Related articles
- systemd/User
- systemd/Timers
- systemd/Journal
- systemd/FAQ
- init
- Daemons
- udev
- Improving performance/Boot process
- Allow users to shutdown From the project web page:
- systemd is a suite of basic building blocks for a Linux system. It provides a system and service manager that runs as PID 1 and starts the rest of the system. systemd provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. systemd supports SysV and LSB init scripts and works as a replacement for sysvinit. Other parts include a logging daemon, utilities to control basic system configuration like the hostname, date, locale, maintain a list of logged-in users and running containers and virtual machines, system accounts, runtime directories and settings, and daemons to manage simple network configuration, network time synchronization, log forwarding, and name resolution.
- If you do not specify the suffix, systemctl will assume .service. For example, and
netctl.service
are equivalent. - Mount points will automatically be translated into the appropriate .mount unit. For example, specifying is equivalent to .
- Similar to mount points, devices are automatically translated into the appropriate .device unit, therefore specifying is equivalent to .
- Most commands also work if multiple units are specified, see systemctl(1) for more information.
- The
--now
switch can be used in conjunction withenable
,disable
, andmask
to respectively start, stop, or mask the unit immediately rather than after rebooting. - A package may offer units for different purposes. If you just installed a package,
pacman -Qql package | grep -Fe .service -e .socket
can be used to check and find them. - See for the directories where available unit files can be found.
- This does not ask the changed units to reload their own configurations (see the Reload action).
- For example, in case its
[Install]
section has changed since last enabling it. - Both manually and as a dependency, which makes masking dangerous. Check for existing masked units with:
- : units provided by installed packages
/etc/systemd/system/
: units installed by the system administrator- (default): systemd considers the service to be started up immediately. The process must not fork. Do not use this type if other services need to be ordered on this service, unless it is socket activated.
- : systemd considers the service started up once the process forks and the parent has exited. For classic daemons, use this type unless you know that it is not necessary. You should specify as well so systemd can keep track of the main process.
- : this is useful for scripts that do a single job and then exit. You may want to set
RemainAfterExit=yes
as well so that systemd still considers the service as active after the process has exited. - : identical to , but with the stipulation that the daemon will send a signal to systemd when it is ready. The reference implementation for this notification is provided by libsystemd-daemon.so.
- : the service is considered ready when the specified
BusName
appears on DBus's system bus. - : systemd will delay execution of the service binary until all jobs are dispatched. Other than that behavior is very similar to .
systemd.unit=multi-user.target
(which roughly corresponds to the old runlevel 3),- (which roughly corresponds to the old runlevel 1).
- Kernel parameter shown above
- Symlink of
- Symlink of
- systemd-boot — simple UEFI boot manager;
- — Enroll PKCS#11, FIDO2, TPM2 token/devices to LUKS2 encrypted volumes;
- systemd-firstboot — basic system setting initialization before first boot;
- systemd-homed — portable human-user accounts;
- — session management;
- systemd-networkd — network configuration management;
- systemd-nspawn — light-weight namespace container;
- systemd-resolved — network name resolution;
- systemd-sysusers(8) — creates system users and groups and adds users to groups at package installation or boot time;
- systemd-timesyncd — system time synchronization across the network;
- systemd/Journal — system logging;
- systemd/Timers — monotonic or realtime timers for controlling .service files or events, reasonable alternative to cron.
- — a UEFI boot stub used for creating unified kernel images.
- The boot loader must set the LoaderDevicePartUUID EFI variable, so that the used EFI system partition can be identified. This is supported by systemd-boot, and rEFInd (not enabled by default). This can be verified by running and checking the status of .
- The root partition must be on the same physical disk as the used EFI system partition. Other partitions that will be automounted must be on the same physical disk as the root partition. This basically means that all automounted partitions must share the same physical disk with the ESP.
- The mount point must be manually created (if desired), otherwise will use
/boot
. - If using NetworkManager, should be enabled together with . Check if this is the case with
systemctl is-enabled NetworkManager-wait-online.service
. If it is not enabled, then reenable . - In the case of netctl, enable the (unless you are using netctl-auto; see ).
- If using systemd-networkd, should be enabled together with . Check if this is the case with
systemctl is-enabled systemd-networkd-wait-online.service
. If it is not enabled, then reenable . - defines a list of capabilities(7) that are allowed or denied for a unit. See .
- The capability, for example, which should be one of the goals of a secure sandbox:
- Wikipedia:systemd
- Official web site
- Manual pages
- Other distributions
- Lennart's blog story, update 1, update 2, update 3, summary
- Debug Systemd Services
- systemd for Administrators (PDF)
- How To Use Systemctl to Manage Systemd Services and Units
- Session management with systemd-logind
- Emacs Syntax highlighting for Systemd files
- Two part introductory article in The H Open magazine.
Basic systemctl usage
The main command used to introspect and control systemd is systemctl. Some of its uses are examining the system state and managing the system and services. See for more details.
Using units
Units commonly include, but are not limited to, services (.service), mount points (.mount), devices (.device) and sockets (.socket).
When using systemctl, you generally have to specify the complete name of the unit file, including its suffix, for example sshd.socket
. There are however a few short forms when specifying the unit in the following systemctl commands:
See for details.
The commands in the below table operate on system units since is the implied default for systemctl. To instead operate on user units (for the calling user), use systemctl --user without root privileges. See also systemd/User#Basic setup to enable/disable user units for all users.
Action | Command | Note |
---|---|---|
Analyzing the system state | ||
Show system status | ||
List running units | or | |
List failed units | ||
List installed unit files1 | ||
Show process status for a PID | cgroup slice, memory and parent | |
Checking the unit status | ||
Show a manual page associated with a unit | as supported by the unit | |
Status of a unit | systemctl status unit | including whether it is running or not |
Check whether a unit is enabled | ||
Starting, restarting, reloading a unit | ||
Start a unit immediately | as root | |
Stop a unit immediately | systemctl stop unit as root | |
Restart a unit | as root | |
Reload a unit and its configuration | as root | |
Reload systemd manager configuration2 | as root | scan for new or changed units |
Enabling a unit | ||
Enable a unit to start automatically at boot | as root | |
Enable a unit to start automatically at boot and start it immediately | as root | |
Disable a unit to no longer start at boot | as root | |
Reenable a unit3 | as root | i.e. disable and enable anew |
Masking a unit | ||
Mask a unit to make it impossible to start4 | as root | |
Unmask a unit | systemctl unmask unit as root |
Power management
polkit is necessary for power management as an unprivileged user. If you are in a local systemd-logind user session and no other session is active, the following commands will work without root privileges. If not (for example, because another user is logged into a tty), systemd will automatically ask you for the root password.
Action | Command |
---|---|
Shut down and reboot the system | |
Shut down and power-off the system | |
Suspend the system | |
Put the system into hibernation | |
Put the system into hybrid-sleep state (or suspend-to-both) |
Writing unit files
The syntax of systemd's unit files () is inspired by XDG Desktop Entry Specification .desktop files, which are in turn inspired by Microsoft Windows .ini files. Unit files are loaded from multiple locations (to see the full list, run ), but the main ones are (listed from lowest to highest precedence):
Look at the units installed by your packages for examples, as well as .
#
may be used in unit-files as well, but only in new lines. Do not use end-line comments after systemd parameters or the unit will fail to activate.Handling dependencies
With systemd, dependencies can be resolved by designing the unit files correctly. The most typical case is when unit A requires unit B to be running before A is started. In that case add and to the section of A. If the dependency is optional, add and instead. Note that and do not imply , meaning that if is not specified, the two units will be started in parallel.
Dependencies are typically placed on services and not on #Targets. For example, network.target
is pulled in by whatever service configures your network interfaces, therefore ordering your custom unit after it is sufficient since network.target
is started anyway.
Service types
There are several different start-up types to consider when writing a custom service file. This is set with the parameter in the section:
See the man page for a more detailed explanation of the values.
Editing provided units
To avoid conflicts with pacman, unit files provided by packages should not be directly edited. There are two safe ways to modify a unit without touching the original file: create a new unit file which overrides the original unit or create drop-in snippets which are applied on top of the original unit. For both methods, you must reload the unit afterwards to apply your changes. This can be done either by editing the unit with (which reloads the unit automatically) or by reloading all units with:
# systemctl daemon-reloadReplacement unit files
To replace the unit file , create the file and reenable the unit to update the symlinks.
Alternatively, run:
# systemctl edit --full unitThis opens in your editor (copying the installed version if it does not exist yet) and automatically reloads it when you finish editing.
Drop-in files
To create drop-in files for the unit file , create the directory and place .conf files there to override or add new options. systemd will parse and apply these files on top of the original unit.
The easiest way to do this is to run:
# systemctl edit unitThis opens the file /etc/systemd/system/unit.d/override.conf
in your text editor (creating it if necessary) and automatically reloads the unit when you are done editing.
Revert to vendor version
To revert any changes to a unit made using do:
# systemctl revert unitExamples
For example, if you simply want to add an additional dependency to a unit, you may create the following file:
As another example, in order to replace the directive, create the following file:
Note how must be cleared before being re-assigned . The same holds for every item that can be specified multiple times, e.g. for timers.
One more example to automatically restart a service:
Targets
systemd uses targets to group units together via dependencies and as standardized synchronization points. They serve a similar purpose as runlevels but act a little differently. Each target is named instead of numbered and is intended to serve a specific purpose with the possibility of having multiple ones active at the same time. Some targets are implemented by inheriting all of the services of another target and adding additional services to it. There are systemd targets that mimic the common SystemVinit runlevels so you can still switch targets using the familiar telinit RUNLEVEL
command.
Get current targets
The following should be used under systemd instead of running :
$ systemctl list-units --type=targetCreate custom target
The runlevels that held a defined meaning under sysvinit (i.e., 0, 1, 3, 5, and 6); have a 1:1 mapping with a specific systemd target. Unfortunately, there is no good way to do the same for the user-defined runlevels like 2 and 4. If you make use of those it is suggested that you make a new named systemd target as /etc/systemd/system/your target
that takes one of the existing runlevels as a base (you can look at as an example), make a directory , and then symlink the additional services from that you wish to enable.
Mapping between SysV runlevels and systemd targets
SysV Runlevel | systemd Target | Notes |
---|---|---|
0 | runlevel0.target, poweroff.target | Halt the system. |
1, s, single | runlevel1.target, rescue.target | Single user mode. |
2, 4 | runlevel2.target, runlevel4.target, multi-user.target | User-defined/Site-specific runlevels. By default, identical to 3. |
3 | runlevel3.target, multi-user.target | Multi-user, non-graphical. Users can usually login via multiple consoles or via the network. |
5 | runlevel5.target, graphical.target | Multi-user, graphical. Usually has all the services of runlevel 3 plus a graphical login. |
6 | runlevel6.target, reboot.target | Reboot |
emergency | emergency.target | Emergency shell |
Change current target
In systemd, targets are exposed via target units. You can change them like this:
# systemctl isolate graphical.targetThis will only change the current target, and has no effect on the next boot. This is equivalent to commands such as or in Sysvinit.
Change default target to boot into
The standard target is , which is a symlink to . This roughly corresponds to the old runlevel 5.
To verify the current target with systemctl:
$ systemctl get-defaultTo change the default target to boot into, change the symlink. With systemctl:
Alternatively, append one of the following kernel parameters to your bootloader:
Default target order
systemd chooses the according to the following order:
systemd components
Some (not exhaustive) components of systemd are:
systemd.mount - mounting
systemd is in charge of mounting the partitions and filesystems specified in . The translates all the entries in into systemd units; this is performed at boot time and whenever the configuration of the system manager is reloaded.
systemd extends the usual fstab capabilities and offers additional mount options. These affect the dependencies of the mount unit. They can, for example, ensure that a mount is performed only once the network is up or only once another partition is mounted. The full list of specific systemd mount options, typically prefixed with x-systemd.
, is detailed in .
An example of these mount options is automounting, which means mounting only when the resource is required rather than automatically at boot time. This is provided in fstab#Automount with systemd.
GPT partition automounting
On UEFI-booted systems, if specific conditions are met, will automount GPT partitions following the Discoverable Partitions Specification and they can thus be omitted from fstab.
The prerequisites are:
/var
For automounting to work, the PARTUUID must match the SHA256 HMAC hash of the partition type UUID (4d21b016-b534-45c2-a9fb-5c16e091fd2d
) keyed by the machine ID. The required PARTUUID can be obtained using:
systemd-sysvcompat
The primary role of (required by ) is to provide the traditional linux init binary. For systemd-controlled systems, is just a symbolic link to its executable.
In addition, it provides four convenience shortcuts that SysVinit users might be used to. The convenience shortcuts are , poweroff(8), and . Each one of those four commands is a symbolic link to , and is governed by systemd behavior. Therefore, the discussion at #Power management applies.
systemd-based systems can give up those System V compatibility methods by using the boot parameter (see, for example, /bin/init is in systemd-sysvcompat ?) and systemd native command arguments.
systemd-tmpfiles - temporary files
systemd-tmpfiles creates, deletes and cleans up volatile and temporary files and directories. It reads configuration files in /etc/tmpfiles.d/
and to discover which actions to perform. Configuration files in the former directory take precedence over those in the latter directory.
Configuration files are usually provided together with service files, and they are named in the style of . For example, the Samba daemon expects the directory to exist and to have the correct permissions. Therefore, the package ships with this configuration:
Configuration files may also be used to write values into certain files on boot. For example, if you used to disable wakeup from USB devices with echo USBE > /proc/acpi/wakeup
, you may use the following tmpfile instead:
See the and man pages for details.
/sys
since the systemd-tmpfiles-setup service may run before the appropriate device modules are loaded. In this case, you could check whether the module has a parameter for the option you want to set with modinfo module
and set this option with a config file in /etc/modprobe.d. Otherwise, you will have to write a udev rule to set the appropriate attribute as soon as the device appears.Tips and tricks
GUI configuration tools
Running services after the network is up
To delay a service until after the network is up, include the following dependencies in the .service file:
The network wait service of the network manager in use must also be enabled so that properly reflects the network status.
For more detailed explanations, see the discussion in the Network configuration synchronization points.
If a service needs to perform DNS queries, it should additionally be ordered after :
See .
For to have any effect it needs a service that pulls it in via and orders itself before it with . Typically this is done by local DNS resolvers.
Check which active service, if any, is pulling in with:
$ systemctl list-dependencies --reverse nss-lookup.targetEnable installed units by default
Arch Linux ships with containing . This causes systemctl preset to disable all units by default, such that when a new package is installed, the user must manually enable the unit.
If this behavior is not desired, simply create a symlink from to in order to override the configuration file. This will cause systemctl preset to enable all units that get installed—regardless of unit type—unless specified in another file in one systemctl preset's configuration directories. User units are not affected. See for more information.
Sandboxing application environments
A unit file can be created as a sandbox to isolate applications and their processes within a hardened virtual environment. systemd leverages namespaces, a list of allowed/denied capabilities, and control groups to container processes through an extensive execution environment configuration—.
The enhancement of an existing systemd unit file with application sandboxing typically requires trial-and-error tests accompanied by the generous use of , stderr and error logging and output facilities. You may want to first search upstream documentation for already done tests to base trials on. To get a starting point for possible hardening options, run
$ systemd-analyze security unitSome examples of how sandboxing with systemd can be deployed:
Notifying about failed services
In order to notify about service failures, a directive needs to be added to the according service file, for example by using a drop-in configuration file. Adding this directive to every service unit can be achieved with a top-level drop-in configuration file. For details about top-level drop-ins, see .
Create a top-level drop-in for services:
This adds OnFailure=failure-notification@%n
to every service file. If some_service_unit fails, will be started to handle the notification delivery (or whatever task it is configured to perform).
Create the template unit:
You can create the script and define what to do or how to notify (mail, gotify, xmpp, etc.). The %i
will be the name of the failed service unit and will be passed as argument to the script.
In order to prevent a recursion for starting instances of again and again if the start fails, create an empty drop-in configuration file with the same name as the top-level drop-in (the empty service-level drop-in configuration file takes precedence over the top-level drop-in and overrides the latter one):
# mkdir -p /etc/systemd/system/failure-notification@.service.d # touch /etc/systemd/system/failure-notification@.service.d/toplevel-override.confAutomatically turn off an external HDD at shutdown
If an external HDD is not powered off properly at system shutdown, it may be desirable to fix the issue. The most convenient way to do this is using udisks.
Enable .
A service to invoke our script might look like so:
Do a systemd daemon-reload to apply the new setting.
Reboot or restart to check if works.
An example script to handle an arbitrary amount of partitions on a single disk looks like so:
uuid_list is a list of space delimited UUIDs corresponding to partitions of the device to check, e.g. "uuid_1" "uuid_2"
.
Troubleshooting
Investigating failed services
To find the systemd services which failed to start:
$ systemctl --state=failedTo find out why they failed, examine their log output. See systemd/Journal#Filtering output for details.
Diagnosing boot problems
systemd has several options for diagnosing problems with the boot process. See boot debugging for more general instructions and options to capture boot messages before systemd takes over the boot process. Also see freedesktop.org's systemd debugging documentation.
Diagnosing a service
If some systemd service misbehaves or you want to get more information about what is happening, set the environment variable to . For example, to run the systemd-networkd daemon in debug mode:
Add a drop-in file for the service adding the two lines:
[Service] Environment=SYSTEMD_LOG_LEVEL=debugOr equivalently, set the environment variable manually:
# SYSTEMD_LOG_LEVEL=debug /lib/systemd/systemd-networkdthen restart systemd-networkd and watch the journal for the service with the / option.
Shutdown/reboot takes terribly long
If the shutdown process takes a very long time (or seems to freeze), most likely a service not exiting is to blame. systemd waits some time for each service to exit before trying to kill it. To find out whether you are affected, see Shutdown completes eventually in the systemd wiki.
A common problem is a stalled shutdown or suspend process. To verify whether that is the case, you could run either of these commands and check the outputs
The solution to this would be to cancel these jobs by running
# systemctl cancel # systemctl stop systemd-suspend.serviceand then trying shutdown or reboot again.
Short lived processes do not seem to log any output
If running journalctl -u foounit
as root does not show any output for a short lived service, look at the PID instead. For example, if fails, and shows that it ran as PID 123, then you might be able to see output in the journal for that PID, i.e. by running as root. Metadata fields for the journal such as _SYSTEMD_UNIT
and are collected asynchronously and rely on the directory for the process existing. Fixing this requires fixing the kernel to provide this data via a socket connection, similar to . In short, it is a bug. Keep in mind that immediately failed services might not print anything to the journal as per design of systemd.
Boot time increasing over time
After using a number of users have noticed that their boot time has increased significantly in comparison with what it used to be. After using NetworkManager is being reported as taking an unusually large amount of time to start.
The problem for some users has been due to becoming too large. This may have other impacts on performance, such as for or journalctl
. As such the solution is to remove every file within the folder (ideally making a backup of it somewhere, at least temporarily) and then setting a journal file size limit as described in Systemd/Journal#Journal size limit.
systemd-tmpfiles-setup.service fails to start at boot
Starting with systemd 219, specifies ACL attributes for directories under and, therefore, requires ACL support to be enabled for the filesystem the journal resides on.
See Access Control Lists#Enable ACL for instructions on how to enable ACL on the filesystem that houses .
Disable emergency mode on remote machine
You may want to disable emergency mode on a remote machine, for example, a virtual machine hosted at Azure or Google Cloud. It is because if emergency mode is triggered, the machine will be blocked from connecting to network.
To disable it, mask and .