Managing Services with systemctl and Reading Logs with journalctl on Ubuntu 26.04 LTS Server

Operating Services and Reading Their Logs

This article explains how to start and stop services (systemd units) on Ubuntu 26.04 LTS Server, how to control whether they start at boot, and how to read their logs with journalctl.

The examples use nginx as the service being operated. The systemd version is 259.

Example: checking the systemd version
kazulog@sv1:~$ systemctl --version | head -2
systemd 259 (259.5-0ubuntu3.4)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF -XKBCOMMON -UTMP +SYSVINIT +LIBARCHIVE
kazulog@sv1:~$

Listing Services and Checking Their State

systemctl list-units lists the services that are currently running.

Command to list running services
systemctl list-units --type=service --state=running

Example: listing running services
kazulog@sv1:~$ systemctl list-units --type=service --state=running --no-pager
  UNIT                        LOAD   ACTIVE SUB     DESCRIPTION
  chrony.service              loaded active running chrony, an NTP client/server
  cron.service                loaded active running Regular background program processing daemon
  dbus.service                loaded active running D-Bus System Message Bus
  getty@tty1.service          loaded active running Getty on tty1
  ModemManager.service        loaded active running Modem Manager
  multipathd.service          loaded active running Device-Mapper Multipath Device Controller
  networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd
  polkit.service              loaded active running Authorization Manager
  rsyslog.service             loaded active running System Logging Service
  serial-getty@ttyS0.service  loaded active running Serial Getty on ttyS0
  ssh.service                 loaded active running OpenBSD Secure Shell server
  systemd-journald.service    loaded active running Journal Service
  systemd-logind.service      loaded active running User Login Management
  systemd-networkd.service    loaded active running Network Management
  systemd-resolved.service    loaded active running Network Name Resolution
  systemd-timedated.service   loaded active running Time & Date Service
  systemd-udevd.service       loaded active running Rule-based Manager for Device Events and Files
  udisks2.service             loaded active running Disk Manager
  unattended-upgrades.service loaded active running Unattended Upgrades Shutdown
  user@1000.service           loaded active running User Manager for UID 1000

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

20 loaded units listed.
kazulog@sv1:~$

systemctl status shows the state of one service.

Command to check the state of a service
systemctl status [SERVICE]

Field	Value
[SERVICE]	Service name (the `.service` suffix may be omitted)

Example: checking the state of a service
kazulog@sv1:~$ systemctl status nginx --no-pager -l | cat
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-09-10 15:48:02 JST; 16s ago
 Invocation: 4e1e63adfe344ba4b6d7bb99d3946a82
       Docs: man:nginx(8)
    Process: 1899 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
    Process: 1901 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
   Main PID: 1929 (nginx)
      Tasks: 2 (limit: 1486)
     Memory: 2.3M (peak: 5M)
        CPU: 57ms
     CGroup: /system.slice/nginx.service
             ├─1929 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
             └─1932 "nginx: worker process"

Sep 10 15:48:02 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:02 sv1 systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
kazulog@sv1:~$

Read the output as follows.

Line	Meaning
Leading symbol	`●` (green) is running, `○` is stopped, `×` is failed
`Loaded:`	Where the unit file lives and whether it starts at boot (`enabled` / `disabled`)
`Active:`	The current state (`active (running)` / `inactive (dead)` / `failed`) and when it was entered
`Main PID:`	Process ID of the main process
Last few lines	Recent log entries for the service (the same as `journalctl -u`)

To check only the state, use is-active and is-enabled. These are convenient inside scripts.

Commands to check the state only
systemctl is-active [SERVICE]
systemctl is-enabled [SERVICE]

Example: checking the state only
kazulog@sv1:~$ systemctl is-active nginx
active
kazulog@sv1:~$ systemctl is-enabled nginx
enabled

Starting, Stopping and Restarting a Service

Commands to operate a service
sudo systemctl start [SERVICE]
sudo systemctl stop [SERVICE]
sudo systemctl restart [SERVICE]
sudo systemctl reload [SERVICE]

Command	Action
`start`	Starts the service
`stop`	Stops the service
`restart`	Stops and starts it again (the process is recreated)
`reload`	Re-reads the configuration without stopping the process (not every service supports it)

Example: starting, stopping and restarting
kazulog@sv1:~$ sudo systemctl stop nginx
kazulog@sv1:~$ systemctl is-active nginx
inactive
kazulog@sv1:~$ systemctl status nginx --no-pager -l | head -12 | cat
○ nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: inactive (dead) since Thu 2026-09-10 15:48:19 JST; 114ms ago
   Duration: 16.971s
 Invocation: 4e1e63adfe344ba4b6d7bb99d3946a82
       Docs: man:nginx(8)
    Process: 1899 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
    Process: 1901 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
    Process: 2217 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
   Main PID: 1929 (code=exited, status=0/SUCCESS)
   Mem peak: 5M
        CPU: 73ms
kazulog@sv1:~$ sudo systemctl start nginx
kazulog@sv1:~$ systemctl is-active nginx
active
kazulog@sv1:~$ sudo systemctl restart nginx
kazulog@sv1:~$ sudo systemctl reload nginx
kazulog@sv1:~$

While stopped, status shows ○ and inactive (dead). These commands print nothing when they succeed, so confirm the result with is-active or status.

Every operation is recorded in the journal.

Example: the operations in the journal
kazulog@sv1:~$ sudo journalctl -u nginx --since '2 min ago' --no-pager | cat
Sep 10 15:48:02 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:02 sv1 systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:48:19 sv1 systemd[1]: Stopping nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:19 sv1 systemd[1]: nginx.service: Deactivated successfully.
Sep 10 15:48:19 sv1 systemd[1]: Stopped nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:48:20 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:20 sv1 systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:48:20 sv1 systemd[1]: Stopping nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:20 sv1 systemd[1]: nginx.service: Deactivated successfully.
Sep 10 15:48:20 sv1 systemd[1]: Stopped nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:48:20 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:20 sv1 systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:48:20 sv1 systemd[1]: Reloading nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:48:20 sv1 nginx[2307]: 2026/09/10 15:48:20 [notice] 2307#2307: signal process started
Sep 10 15:48:20 sv1 systemd[1]: Reloaded nginx.service - A high performance web server and a reverse proxy server.

Controlling Start at Boot

start means “run it now”; enable means “run it at the next boot”. The two are independent, so you can do one without the other.

Command	Action
`sudo systemctl enable [SERVICE]`	Starts at boot (does not start it now)
`sudo systemctl disable [SERVICE]`	Does not start at boot (does not stop it now)
`sudo systemctl enable --now [SERVICE]`	Starts at boot and starts it now
`sudo systemctl disable --now [SERVICE]`	Does not start at boot and stops it now

A running service keeps running after disable.

Example: disabling start at boot
kazulog@sv1:~$ sudo systemctl disable nginx
Synchronizing state of nginx.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable nginx
Removed '/etc/systemd/system/multi-user.target.wants/nginx.service'.
kazulog@sv1:~$ systemctl is-enabled nginx
disabled
kazulog@sv1:~$ systemctl is-active nginx
active
kazulog@sv1:~$

After a reboot, a disabled service does not start.

Example: the state after a reboot
kazulog@sv1:~$ systemctl is-enabled nginx
disabled
kazulog@sv1:~$ systemctl is-active nginx
inactive
kazulog@sv1:~$ systemctl status nginx --no-pager -l | head -4 | cat
○ nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:nginx(8)

enable --now enables and starts the service in one command.

Example: enabling and starting at once
kazulog@sv1:~$ sudo systemctl enable --now nginx
Synchronizing state of nginx.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable nginx
Created symlink '/etc/systemd/system/multi-user.target.wants/nginx.service' → '/usr/lib/systemd/system/nginx.service'.
kazulog@sv1:~$ systemctl is-enabled nginx
enabled
kazulog@sv1:~$ systemctl is-active nginx
active

list-unit-files lists the services that start at boot.

Example: listing the services that start at boot
kazulog@sv1:~$ systemctl list-unit-files --type=service --state=enabled --no-pager | head -12
UNIT FILE                              STATE   PRESET
apparmor.service                       enabled enabled
apport.service                         enabled enabled
blk-availability.service               enabled enabled
chrony.service                         enabled enabled
cloud-config.service                   enabled enabled
cloud-final.service                    enabled enabled
cloud-init-local.service               enabled enabled
cloud-init-main.service                enabled enabled
cloud-init-network.service             enabled enabled
console-setup.service                  enabled enabled
cron.service                           enabled enabled

Preventing a Service from Being Started (mask)

mask replaces the unit with a symbolic link to /dev/null, so it cannot be started even manually. Use it to keep a service from being started unintentionally, for example by a package update.

Commands to mask and unmask a service
sudo systemctl mask [SERVICE]
sudo systemctl unmask [SERVICE]

Example: masking and unmasking
kazulog@sv1:~$ sudo systemctl mask nginx
Created symlink '/etc/systemd/system/nginx.service' → '/dev/null'.
kazulog@sv1:~$ systemctl is-enabled nginx
masked
kazulog@sv1:~$ sudo systemctl start nginx
Failed to start nginx.service: Unit nginx.service is masked.
kazulog@sv1:~$ sudo systemctl unmask nginx
Removed '/etc/systemd/system/nginx.service'.
kazulog@sv1:~$ sudo systemctl start nginx
kazulog@sv1:~$ systemctl is-active nginx
active
kazulog@sv1:~$

Investigating a Service That Fails to Start

systemctl --failed lists the services that are in the failed state.

Command to list failed services
systemctl --failed

Example: restarting with an error in the configuration file
kazulog@sv1:~$ sudo systemctl restart nginx
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
kazulog@sv1:~$ systemctl is-active nginx
failed
kazulog@sv1:~$ systemctl --failed --no-pager
  UNIT          LOAD   ACTIVE SUB    DESCRIPTION
● nginx.service loaded failed failed A high performance web server and a reverse proxy server

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

1 loaded units listed.
kazulog@sv1:~$ systemctl status nginx --no-pager -l | head -14 | cat
× nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Thu 2026-09-10 15:49:41 JST; 151ms ago
   Duration: 11.927s
 Invocation: 87d8bbb0ef24470d85db158ae79b23bd
       Docs: man:nginx(8)
    Process: 1911 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
   Mem peak: 1.7M
        CPU: 16ms

Sep 10 15:49:41 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:49:41 sv1 nginx[1911]: 2026/09/10 15:49:41 [emerg] 1911#1911: unknown directive "brokendirective" in /etc/nginx/conf.d/broken.conf:1
Sep 10 15:49:41 sv1 nginx[1911]: nginx: configuration file /etc/nginx/nginx.conf test failed
Sep 10 15:49:41 sv1 systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
kazulog@sv1:~$

Three places tell you what happened.

Where to look	What it tells you
The `Active:` line	`failed (Result: exit-code)` and when it failed
The `Process:` lines	Which process failed (`status=1/FAILURE` is the exit code)
The log at the end	The cause. Above, nginx reports `unknown directive "brokendirective"`

-p err selects only entries at error level or higher.

Example: selecting only error entries
kazulog@sv1:~$ sudo journalctl -u nginx -p err --since '2 min ago' --no-pager | cat
Sep 10 15:49:41 sv1 systemd[1]: Failed to start nginx.service - A high performance web server and a reverse proxy server.
kazulog@sv1:~$

Removing the cause and running restart brings the service back.

Example: recovering the service
kazulog@sv1:~$

Changing a Service’s Settings (Drop-ins)

Do not edit the unit files shipped by packages (under /usr/lib/systemd/system/). Put a .conf file in /etc/systemd/system/[SERVICE].service.d/ to override settings and load it with daemon-reload.

Commands to create and apply a drop-in
sudo systemctl edit [SERVICE]
sudo systemctl daemon-reload
sudo systemctl restart [SERVICE]

systemctl edit opens an editor and writes override.conf when you save. Creating the file directly has the same effect.

Example: creating and applying a drop-in
kazulog@sv1:~$ sudo mkdir -p /etc/systemd/system/nginx.service.d
kazulog@sv1:~$ printf '[Service]\nRestart=on-failure\nRestartSec=5\n' | sudo tee /etc/systemd/system/nginx.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5
kazulog@sv1:~$ sudo systemctl daemon-reload
kazulog@sv1:~$ sudo systemctl restart nginx
kazulog@sv1:~$ systemctl cat nginx | tail -6
WantedBy=multi-user.target

# /etc/systemd/system/nginx.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5
kazulog@sv1:~$ systemctl show nginx -p Restart -p RestartUSec
Restart=on-failure
RestartUSec=5s

systemctl cat shows the unit file and the drop-ins together. The example adds a setting that restarts the service five seconds after it exits abnormally.

Nothing takes effect until you run daemon-reload. The surest way to confirm a value is systemctl show [SERVICE] -p [PROPERTY].

Reading Logs with journalctl

systemd logs are read with journalctl. The most useful options are:

Option	Meaning
`-u [SERVICE]`	Only entries for that service
`-n [N]`	Only the last N lines
`-f`	Keep printing new entries (`Ctrl+C` to stop)
`-b`	Entries since this boot. `-b -1` is the previous boot
`--since` / `--until`	A time range (`"10 min ago"`, `"2026-09-10 15:00"`)
`-p [PRIORITY]`	Filter by priority (`err`, `warning`, `info`)
`--no-pager`	Print without a pager

Command to read a service's log
sudo journalctl -u [SERVICE] -n 20

Example: the last five lines
kazulog@sv1:~$ sudo journalctl -u nginx -n 5 --no-pager | cat
Sep 10 15:49:52 sv1 systemd[1]: Stopping nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:49:52 sv1 systemd[1]: nginx.service: Deactivated successfully.
Sep 10 15:49:52 sv1 systemd[1]: Stopped nginx.service - A high performance web server and a reverse proxy server.
Sep 10 15:49:52 sv1 systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Sep 10 15:49:52 sv1 systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
kazulog@sv1:~$

Combine --since and --until to select a time range. When nothing matches, -- No entries -- is printed.

Example: selecting a time range
kazulog@sv1:~$ sudo journalctl -u nginx --since '10 min ago' --until '5 min ago' --no-pager | head -5 | cat
-- No entries --
kazulog@sv1:~$

-b limits the output to the current boot. -b -1 reads the previous boot, which shows what happened before a restart.

Example: the end of the previous boot's log
kazulog@sv1:~$ sudo journalctl -b -1 --no-pager | tail -4 | cat
Sep 10 15:48:37 sv1 systemd-shutdown[1]: Syncing filesystems and block devices.
Sep 10 15:48:37 sv1 systemd-shutdown[1]: Sending SIGTERM to remaining processes...
Sep 10 15:48:37 sv1 systemd-journald[588]: Received SIGTERM from PID 1 (systemd-shutdow).
Sep 10 15:48:37 sv1 systemd-journald[588]: Journal stopped
kazulog@sv1:~$

--list-boots lists the boots that are still recorded.

Example: listing the recorded boots
kazulog@sv1:~$ sudo journalctl --list-boots --no-pager | cat
IDX BOOT ID                          FIRST ENTRY                 LAST ENTRY
 -4 86eabfe1a02f41f495461c35e41ba1e1 Thu 2026-09-10 13:29:59 JST Thu 2026-09-10 13:35:24 JST
 -3 97c1d18c29b44f12b3d72adc2fa94bb7 Thu 2026-09-10 13:56:38 JST Thu 2026-09-10 13:57:45 JST
 -2 97239a4ef00a4330845686247b03fce9 Thu 2026-09-10 14:39:13 JST Thu 2026-09-10 15:00:27 JST
 -1 bb94a595d49d44859c82f7293889dc8f Thu 2026-09-10 15:46:55 JST Thu 2026-09-10 15:48:37 JST
  0 a06471efe1864ea8b5885524c0299227 Thu 2026-09-10 15:48:57 JST Thu 2026-09-10 15:50:15 JST
kazulog@sv1:~$

To see system-wide errors only, use -p err.

Example: errors since this boot
kazulog@sv1:~$ sudo journalctl -p err -b --no-pager | cat
Sep 10 15:49:41 sv1 systemd[1]: Failed to start nginx.service - A high performance web server and a reverse proxy server.
kazulog@sv1:~$

Where Logs Are Stored and How Much Space They Use

If /var/log/journal/ exists, logs are written to disk and survive a reboot. Otherwise they go to /run/log/journal/ in memory and are lost at reboot. --disk-usage reports the space in use.

Example: storage location and disk usage
kazulog@sv1:~$ journalctl --disk-usage
Archived and active journals take up 72M in the file system.
kazulog@sv1:~$ ls -d /var/log/journal/*
/var/log/journal/435660ecd769447c8d3e12c234a35841

In this example the logs are stored on disk, which is also why --list-boots lists earlier boots.

Test Environment and Session Logs

The examples were captured on Ubuntu 26.04 LTS Server (systemd 259, nginx 1.28.3) running on CML. The session log of each step can be downloaded below.

Step	Session log
Initial state (service list, log storage)	log
Installing nginx	log
Checking the state of a service	log
Start, stop, restart and reload	log
Disabling start at boot, then rebooting	log
The state after the reboot	log
Enabling and starting (enable –now)	log
Investigating a failed start	log
Changing settings with a drop-in	log
journalctl options	log
mask and unmask	log

Reference

systemd documentation: systemctl