Services and logs

A service (or daemon) is a program that runs in the background, usually from start-up: a web server, a database, the SSH server. On nearly every modern distribution, systemd starts and watches them, and systemctl is how you control it.

$ systemctl status nginx
● nginx.service - A high performance web server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
     Active: active (running) since Tue 2026-10-21 09:12:03 UTC

start and stop change it now; restart does both, and reload asks it to reread its settings without dropping anyone connected (not every service supports it). enable makes it start at boot and disable stops that. Starting and enabling are separate: sudo systemctl enable --now nginx does both at once.

$ sudo systemctl restart nginx
$ sudo systemctl enable --now postgresql
$ systemctl list-units --type=service --state=failed

When a service misbehaves, read its log. systemd collects every service's output in the journal: journalctl -u nginx shows nginx's, -f follows it live, -e jumps to the end, and --since "1 hour ago" narrows it. journalctl -b is everything since the last boot.

Many programs also write their own logs under /var/log, for example /var/log/nginx/error.log, and on Debian and Ubuntu logins and sudo use are recorded in /var/log/auth.log.

A good habit after changing a service's settings: check the file first if the program can (sudo nginx -t), then reload or restart, then systemctl status to see it came back up.