• United States
Unix Dweeb

Viewing enabled and running services on Linux with systemctl

Jul 29, 20215 mins

Systemd and the systemctl command play vital roles in most of today's Linux systems. This post explains commands for peering into some aspects of how they work.

radar grid overlays the pupil of an eye / intrusion detection / scanning / threat assessment
Credit: ddukang / Getty Images

A vast majority of Linux systems these days are using systemd – a suite of programs aimed at managing and interconnecting different parts of the system. Systemd started replacing the init process back in 2014 and is now the first process that starts when most Linux systems boot. To get a quick peek, you can run a command like this, which verifies that process 1 is indeed systemd. On this system, two additional systemd processes are currently also running.

$ ps -C systemd
    PID TTY          TIME CMD
      1 ?        00:00:59 systemd	
   1244 ?        00:00:00 systemd
  54429 ?        00:00:00 systemd

To see a little more detail, try the command below. The blank within the quotes is meant to prevent related processes like systemd-journald from showing up in the list.

$ ps -ef | grep "systemd " | grep -v grep
root    1   0 0 Jul17 ?    00:00:59 /usr/lib/systemd/systemd --system --deserialize 30
gdm  1244   1 0 Jul17 ?    00:00:00 /usr/lib/systemd/systemd --user
shs  5429   1 0 Jul19 ?    00:00:00 /usr/lib/systemd/systemd --user

The first process listed (with –system) is the primary systemd process. The second and third are managing user (–user) sessions. In this case, one is associated with the GNOME display manager (gdm) and the other with a logged-in user.

If you look at all running systemd processes, you’re likely to see these. Each plays a role in managing system services. For example, system-journald collects and stores logging data.


To view or control systemd services, use the systemctl command. You can view running processes with a command like this:

$ systemctl | head -1; systemctl | grep running | head -11
 UNIT                               LOAD   ACTIVE SUB       DESCRIPTION
 proc-sys-fs-binfmt_misc.automount  loaded active running   Arbitrary Executable File Formats File System
 cups.path                          loaded active running   CUPS Scheduler
 init.scope                         loaded active running   System and Service Manager
 session-13.scope                   loaded active running   Session 13 of User shs
 session-6.scope                    loaded active running   Session 6 of User shs
 session-c1.scope                   loaded active running   Session c1 of User gdm
 abrt-journal-core.service          loaded active running   Creates ABRT problems from coredumpctl messages
 abrt-oops.service                  loaded active running   ABRT kernel log watcher
 abrt-xorg.service                  loaded active running   ABRT Xorg log watcher
 abrtd.service                      loaded active running   ABRT Automated Bug Reporting Tool
 accounts-daemon.service            loaded active running   Accounts Service

I added the systemctl | head -1 in the command above to provide column headings.

For systemd, the word “UNIT” refers to any resource that the system knows how to operate and manage. To list those that are enabled, you can use a command like this:

$ systemctl list-unit-files --state=enabled | head -15
UNIT FILE                          STATE   VENDOR PRESET
cups.path                          enabled enabled
abrt-journal-core.service          enabled enabled
abrt-oops.service                  enabled enabled
abrt-vmcore.service                enabled enabled
abrt-xorg.service                  enabled enabled
abrtd.service                      enabled enabled
accounts-daemon.service            enabled enabled
atd.service                        enabled enabled
auditd.service                     enabled enabled
avahi-daemon.service               enabled enabled
bluetooth.service                  enabled enabled
chronyd.service                    enabled enabled
crond.service                      enabled enabled
cups.service                       enabled disabled

Note that “enabled” doesn’t mean that a service is running. And “running” doesn’t necessarily mean that it’s enabled. Each means something different. “Enabled” means that the system will run the service on the next boot (whether or not it’s running now). Once you enable a service, you still need to manually start it if you want it to run right away, or you can reboot the system and it will start automatically.

The “running” status means that the process is actually running. If it’s not also enabled, it won’t restart when you reboot.

In the commands below, we can see that the web service is both enabled and running:

$ systemctl list-unit-files | head -1; systemctl list-unit-files | grep http
UNIT FILE                        STATE           VENDOR PRESET
httpd.service                    enabled         disabled  
httpd@.service                   disabled        disabled
httpd.socket                     disabled        disabled

$ systemctl | grep running | grep http
  httpd.service     loaded active running   The Apache HTTP Server 

You can view a lot more information related to this service by asking for its status:

$ systemctl status httpd.service
● httpd.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
     Active: active (running) since Sat 2021-07-17 18:21:44 EDT; 1 week 1 day ago
       Docs: man:httpd.service(8)
   Main PID: 876 (httpd)
     Status: "Total requests: 154; Idle/Busy workers 100/0;Requests/sec: 0.000204; Bytes served/sec:   0 B/sec"
      Tasks: 213 (limit: 7072)
     Memory: 20.3M
        CPU: 1min 58.761s
     CGroup: /system.slice/httpd.service
             ├─   876 /usr/sbin/httpd -DFOREGROUND
             ├─394234 /usr/sbin/httpd -DFOREGROUND
             ├─394235 /usr/sbin/httpd -DFOREGROUND
             ├─394236 /usr/sbin/httpd -DFOREGROUND
             └─394237 /usr/sbin/httpd -DFOREGROUND

Jul 25 00:00:07 dragonfly systemd[1]: Reloaded The Apache HTTP Server.
Jul 25 00:00:08 dragonfly httpd[876]: Server configured, listening on: port 80

Alternately, you can simply determine whether a particular service is active and/or enabled with commands like these:

$ systemctl is-active httpd.service
$ systemctl is-enabled httpd.service


The systemctl command provides different details on system processes than the ps command. Where ps only lists processes which are running, systemctl lists which services are known, which can be managed by systemd and whether services are enabled.

Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author