Modern distros manage background programs (services) and their logs with
systemd. Two commands control nearly everything: systemctl for services
and journalctl for logs.
systemctl — control services
systemctl starts, stops, restarts and checks services. A service is a
background program with a name ending in .service (the suffix is usually
optional in commands).
Check whether a service is running:
$ systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/usr/lib/systemd/system/ssh.service)
Active: active (running)
| Command | Effect |
|---|---|
systemctl status NAME |
status and recent log lines |
sudo systemctl start NAME |
start it now |
sudo systemctl stop NAME |
stop it now |
sudo systemctl restart NAME |
stop then start |
sudo systemctl enable NAME |
start automatically at boot |
sudo systemctl disable NAME |
don’t start at boot |
sudo systemctl enable --now NAME |
enable AND start now |
Check a single yes/no answer:
$ systemctl is-active ssh
active
$ systemctl is-enabled ssh
enabled
List running services:
$ systemctl list-units --type=service --state=running
These commands need sudo only when they change the system (start, stop,
enable, disable); checking status works without it.
journalctl — read the logs
journalctl reads the system journal — every logged message from systemd and
the services.
Show the last messages:
$ journalctl -n 20
Follow new messages live (like tail -f):
$ journalctl -f
Show messages from one service only:
$ journalctl -u ssh
Filter by time:
$ journalctl --since "2 hours ago"
$ journalctl --since "2026-08-05 09:00" --until "2026-08-05 10:00"
For a searchable list with all options, journalctl --help and the man page
man journalctl are the reference.
Logs live in a ring buffer, so they are automatically pruned to keep the system healthy — you don’t need to delete log files by hand.
Many older services write logs to files that get rotated and compressed
(.gz). zcat and zgrep read those compressed files without extracting
them — think cat and grep, but for gzipped text:
$ zcat /var/log/syslog.1.gz
$ zgrep "error" /var/log/syslog.1.gz
Graphical alternative: GNOME Logs shows the same messages in a GUI, but
journalctl -f -u <service>is faster when debugging a specific service.
A warning: systemctl stop on the wrong service (for example a network
or storage service) can cut you off from a remote machine. When in doubt,
status first, restart rather than stop.