Skip to content

Chapter 3 of 8

Systemd, Logging, and Scheduled Tasks

Modern Linux distributions manage services through systemd, and a small set of systemctl verbs covers most needs. systemctl start, stop, and restart control running state, while reload asks a service to re-read configuration without a full restart when supported. systemctl enable adds a unit to the boot sequence, disable removes it, and systemctl --failed lists units that failed to start. Inspecting a unit is done with systemctl status for state, PID, and recent logs; systemctl cat for the full definition including drop-ins; systemctl show for key/value properties (optionally filtered with -p); and systemctl list-dependencies for the dependency graph. Local overrides can be created with systemctl edit name.service, which writes a snippet under /etc/systemd/system/name.service.d/, and after any unit file change, systemctl daemon-reload refreshes systemd's view. systemctl mask links a unit to /dev/null, preventing manual or dependency-driven starts until unmasked, and systemd-analyze blame lists units sorted by startup time while systemd-analyze critical-chain reveals which dependencies delayed boot.

Logging in systemd environments centers on journald, which stores entries in binary form accessible via journalctl. Common filters include -u name for a specific unit, -f to follow new entries live, -p err to restrict by priority, -k for kernel messages, -b for the current boot and -b -1 for the previous one, and --since "..." --until "..." for arbitrary time ranges. journalctl -xe shows recent entries with extra explanatory text, ideal for troubleshooting failures, while journalctl -o json-pretty outputs logs as formatted JSON, and journalctl > logs.txt or journalctl --output=export exports to file. Disk usage can be checked with journalctl --disk-usage and old entries trimmed with journalctl --vacuum-time=2weeks. The traditional alternative rsyslog writes plain text logs to /var/log; both can coexist. logrotate, configured under /etc/logrotate.conf and /etc/logrotate.d/, rotates, compresses, and prunes log files; logrotate -f forces an immediate run, and -d performs a dry run.

Scheduled tasks come in several flavors. User cron jobs are edited with crontab -e and listed with crontab -l, while /etc/crontab is the system crontab with an extra user column. Cron expressions encode minute, hour, day-of-month, month, and day-of-week, so */5 * * * * means every five minutes and 0 2 * * 0 is 02:00 every Sunday. Because cron runs with a minimal environment, commands can be tested with env -i /bin/sh -c 'command'. anacron complements cron on systems that are not always on, executing missed jobs when the system returns. For one-off scheduling, at 03:00 queues commands for later execution, atq lists them, and atrm JOBID removes one. systemd also offers timers (systemctl list-timers) and one-shot scheduling via systemd-run --on-active=5m command, which creates a transient service and timer. Boot targets in systemd define the runlevel: systemctl set-default multi-user.target switches to text mode and systemctl isolate switches at runtime, while systemctl rescue enters single-user/rescue mode. Boot parameters are visible in /proc/cmdline, kernel modules in lsmod, and module info via modinfo module_name; initramfs is regenerated with update-initramfs -u and GRUB config with update-grub on Debian/Ubuntu. Kernel messages come from dmesg, with dmesg -w for real-time watching, dmesg -T for human-readable timestamps, and dmesg -C to clear the ring buffer.

All chapters
  1. 1SSH, Remote Access, and File Transfer
  2. 2DNS and Name Resolution
  3. 3Systemd, Logging, and Scheduled Tasks
  4. 4Users, Permissions, and Linux Security
  5. 5Storage, Filesystems, and LVM
  6. 6Networking, Firewalls, and Diagnostics
  7. 7Web Servers, SSL/TLS, and Hosting Panels
  8. 8Process Management, Performance, and Containers

Drill it

Reading is not remembering. These come from the Sysadmin Cards deck:

Q

What is the purpose of the <code>~/.ssh/config</code> file?

It allows users to define shortcuts and configuration options (like Hostname, User, Port, IdentityFile) for SSH connections.

Q

What are the recommended permissions for the <code>~/.ssh/authorized_keys</code> file?

600 (read/write for owner only).

Q

What is a DNS <b>CNAME</b> record?

A Canonical Name record that maps one domain name (alias) to another domain name (canonical).

Q

What is a DNS <b>MX</b> record?

A Mail Exchange record that specifies the mail server responsible for accepting email messages on behalf of a domain.