Linux Processes, Packages and Services from the Command Line

A program such as /usr/bin/sleep is a file on disk. A process is a running instance of that program, with its own memory and resources. Three commands running the same program create three processes. Each live process has a PID, a process ID; Linux can reuse that number after it exits.

Find the process and its parent

A process is normally started by another process, its parent. The PPID column gives that parent's PID. Commands you start in a shell are its children. PID 1 is the first process started by the kernel; on a systemd system, it is systemd. pstree -p draws these family relationships when installed.

ps takes a snapshot. Its default selection is processes with your effective user ID on your current terminal. For a system-wide view, choose the columns you need:

The BSD-style form ps aux has no dash. The USER field identifies the account whose permissions the process uses. A root process can access resources that a regular user's process cannot.

Read one line

Consider this example from ps aux:

www-data 2417 0.3 1.2 214560 48212 ? S 09:14 0:02 nginx: worker process

The owner is www-data, the PID is 2417, and CPU use has averaged 0.3% since startup. The process currently holds 1.2% of RAM. RSS is resident memory: 48,212 KiB, about 47.1 MiB. VSZ, 214,560 KiB, also includes virtual address space that is not resident in RAM. A large VSZ alone is not evidence of a memory shortage.

The ? means there is no controlling terminal. State S means sleeping, usually waiting for work. START is 09:14; TIME is two seconds of CPU work. TIME is not elapsed time: a server can run for days while using very little CPU.

Recognize process states

STAT may add flags: + for a foreground terminal group, s for a session leader, l for multiple threads, N for reduced CPU priority and < for raised priority. Sleeping is normal. A zombie is already dead and uses no CPU; sending it another termination signal cannot collect its exit status. A growing collection of zombies points to a parent program that needs attention.

Narrow the search

pgrep -a nginx shows matching PIDs and command lines. Patterns can match several names: pgrep ssh can find both sshd and ssh-agent. pgrep -u alice selects by owner; pidof nginx looks for a program name. A ps pipeline through grep can also show the grep process itself.

For the five largest memory users, run:

ps -eo pid,ppid,user,%mem,cmd --sort=-%mem | head -n 6

There are six lines because the first is a header. ps -p 2417 checks one PID. /proc/2417/status exposes its name, state, parent and memory details. /proc is a virtual view supplied by the kernel, not stored process reports on disk; the PID directory disappears when the process exits.

A snapshot tells you what exists; repeated observations show what is changing. top combines a live process list with totals for CPU activity, load, memory and swap. Read the summary and the busy processes together before deciding which resource is under pressure.

Work with top

Run top. Press P to sort by CPU, M to sort by memory, 1 to show each CPU, h for help and q to quit. Its k and r commands send signals and change nice values. htop offers another interactive view but may need installation.

The process columns include PID, USER, PR, NI, VIRT, RES, SHR, state, %CPU, %MEM, TIME+ and COMMAND. RES is resident RAM, like RSS in ps; VIRT includes reserved address space. In top's default per-CPU mode, a multithreaded process can reach 400% by keeping four CPUs busy. Pressing I switches the display to divide usage by the CPU count.

Identify the kind of CPU activity

The CPU summary splits time into categories:

High user CPU use suggests computation. High wa with little user work directs attention toward storage waits. In a virtual machine, high st points to CPU time withheld by the host. These are different causes of a slow response.

Compare load with CPU capacity

uptime and top show load averages for the last 1, 5 and 15 minutes. Linux counts runnable tasks and tasks in uninterruptible sleep, including storage waits. Load is not a CPU percentage. nproc reports CPUs available to the current process, which is useful when interpreting capacity.

For CPU-bound work with little storage waiting, suppose nproc reports 4 and load is 6.00, 5.20, 3.10. The recent load is 1.5 tasks per CPU, so work has been queuing. The shorter-period value exceeds the longer-period value, showing a recent rise. On 16 CPUs, a load of 6 would be much lighter. A high load with idle CPUs can instead come from state-D tasks.

Judge memory with available

Run free -h. Its Mem row includes total, used, free, shared, buff/cache and available. Linux fills spare RAM with useful disk caches and can reclaim much of it. Free counts completely unused RAM; available estimates how much new work can use without swapping.

For example, a machine reports total 7.6Gi, used 3.1Gi, free 0.4Gi, buff/cache 4.6Gi and available 4.5Gi. The small free figure is not a shortage: about 59% remains available. In current procps versions, used is total minus available; free, used and cache are not a simple partition to add together.

The suffixes Ki, Mi and Gi are binary units. A GiB is 1,073,741,824 bytes; a GB is 1,000,000,000 bytes. free -m uses MiB and free -g whole GiB, which can hide small amounts through rounding.

Swap moves some memory contents to slower disk storage. Watch for low available memory together with growing swap use. If memory is exhausted, the kernel's out-of-memory killer can end a process. Check sudo journalctl -k for an OOM message before assuming an application crashed on its own.

A signal is a short notification delivered to a process. It can request an exit, pause work or tell a service to reread settings. The kill command sends signals; its name does not mean that every signal kills the recipient.

Choose the signal

Most signals can be handled or ignored by the program. SIGKILL and SIGSTOP cannot be caught, blocked or ignored. kill -l lists names and numbers. Common x86 and ARM numbers include TERM 15, KILL 9, INT 2, HUP 1, QUIT 3, CONT 18, STOP 19 and TSTP 20. Names avoid architecture-dependent numbering.

Stop one process carefully

First establish what the process is. ps -p 5120 -o pid,user,stat,cmd lets you inspect the PID, owner, state and command. Then request a clean exit:

kill -TERM 5120

kill 5120, kill -15 5120 and kill -s TERM 5120 send the same request. A clean exit lets the application save work, close files and remove lock files. Give it time to respond, then run ps -p 5120 again. If only the header appears, it has exited.

If the same live process is still stuck after the wait, kill -KILL 5120 is the forced fallback. It loses the application's chance to clean up, so unsaved work and leftover temporary files may remain. Recheck the identity before escalating: PIDs can be reused after exit.

Match names before acting

pkill selects by a name pattern; killall selects a program name. Both normally send SIGTERM. Preview a broad pattern with pgrep -a fire before using pkill fire: that pattern can select more processes than the one you intended. pkill -u bob selects all of bob's processes, not a single application.

killall -HUP rsyslogd sends HUP to the matching logging processes. HUP's effect belongs to the application: check that it supports reloading before treating the signal as a reload command. For a systemd-managed service, use sudo systemctl stop NAME; the manager handles the service's process group and will not treat the requested stop as a failure to repair automatically.

Understand permissions and states

A regular account normally controls its own processes. An attempt to signal another account's process can produce "Operation not permitted"; sudo supplies root authority when needed. Verify the target before using that authority, because stopping the wrong service affects other users.

A process in state D can remain visible after SIGKILL while waiting for storage to respond. Repeating the signal does not repair that storage. A zombie in state Z has already exited; its parent must collect its exit status. Inspecting the state therefore matters when the process does not disappear.

Keyboard shortcuts target the foreground process group. Ctrl+C usually ends the work; Ctrl+Z pauses it and keeps its memory and open files. Terminal closure commonly leads to HUP and termination of attached jobs, which is why long tasks need deliberate handling.

A foreground job occupies the terminal until it finishes or stops. A background job lets the shell accept another command while it runs. Job control changes where work runs; CPU priority changes how it competes with other work.

Move work between foreground and background

An ampersand starts a command in the background:

sleep 300 &

The shell might print [1] 6431. Here 1 is its local job number, and 6431 is the system-wide PID. jobs lists only this shell's jobs. fg %1 brings job 1 to the foreground. If you pause that foreground job with Ctrl+Z, bg %1 resumes it in the background. Without a number, fg and bg choose the job marked +.

Try the sequence with sleep 300: run it in the foreground, press Ctrl+Z, run bg, inspect jobs, then run fg and press Ctrl+C. "Stopped" means paused, not finished. A stopped job uses no CPU but still holds memory and open files. Bash may warn "There are stopped jobs" when you try to exit.

Keep output and logout under control

A background command can still print into the terminal. Redirect both output streams for a long task:

./report.sh > report.log 2>&1 &

The first redirection sends normal output to the file. 2>&1 sends error output to that same destination. The final & returns the prompt while the task runs.

Backgrounding alone does not protect a job from terminal closure. To start work that ignores SIGHUP, use:

nohup ./long-task.sh > task.log 2>&1 &

Without explicit output redirection, nohup commonly writes terminal-bound output to nohup.out. In Bash, disown %1 removes an existing job from the shell's job table, so Bash does not forward HUP to it. The program still needs usable input and output destinations. A program intended to run permanently is better managed as a service.

Give interactive work room to run

The nice value expresses CPU scheduling priority for ordinary processes. Values run from -20, highest priority, to 19, lowest priority; the usual starting value is 0. Higher values give competing work more opportunity. A nice-19 process can still use an otherwise idle CPU fully.

nice -n 10 xz -9 big.log
renice -n 15 -p 6431

The first command starts compression with a positive niceness adjustment; from the usual value 0 it becomes 10. The second changes the running process's nice value to 15. nice without -n applies an adjustment of 10. An ordinary user can generally raise their own process's nice value, reducing its CPU priority. Raising priority by lowering the value normally needs root, for example sudo renice -n -5 -p 6431.

In top, NI shows the nice value; for ordinary time-sharing processes PR is commonly 20 plus NI. Nice 10 therefore appears as PR 30. In ps aux, N marks reduced priority and < raised priority. Niceness affects CPU competition, not disk-access priority; ionice controls a separate resource.

Before installing software or sizing a workload, find out what the system actually offers. The architecture determines which machine-code packages run. CPU availability helps explain load, and usable RAM limits the work that fits in memory.

Separate the kernel from the distribution

Ubuntu 24.04 is a distribution release; a value such as 6.8.0-45-generic identifies the kernel running inside it. Installing a new kernel does not switch the running kernel immediately: that happens at reboot.

Architecture labels differ between package families. Debian packages use amd64 for the architecture reported by uname as x86_64, and arm64 for aarch64. RPM packages commonly use x86_64 and aarch64 directly. Match the build to the machine before installing it.

Count cores and logical CPUs

lscpu reports architecture, model, sockets, cores per socket, threads per core and logical CPUs. For a uniform CPU layout:

One socket with six cores and two threads per core gives 12 logical CPUs. There are still six physical cores. Two hardware threads share resources within a core, so 12 logical CPUs do not promise twice the performance of six cores.

nproc reports processing units available to the current process; CPU affinity or resource limits can make this smaller than the machine-wide count. /proc/cpuinfo provides CPU details directly. On x86, grep -c ^processor /proc/cpuinfo counts processor entries, and the vmx or svm flags show hardware virtualization support. ARM exposes different fields.

Read usable and installed memory

free -h gives a convenient RAM summary. /proc/meminfo provides details: MemTotal is usable RAM and MemAvailable estimates the capacity new work can use. This file labels its figures kB, but they are kibibytes, or 1,024 bytes each.

For example, MemTotal: 16303448 kB converts to about 15.5 GiB after division by 1,024 twice. A machine with 16 GiB of physical modules can show less usable RAM because firmware and kernel reservations use some of it.

To inspect installed modules and slots, run sudo dmidecode -t memory. sudo dmidecode -t system reports firmware-provided manufacturer, model and serial data. A virtual machine reports its virtual hardware. sudo lshw -short, when installed, provides a compact hardware inventory.

Check a requirement as separate tests

Suppose software needs a 64-bit ARM system, at least four available CPUs and 8 GB of RAM. uname -m returning aarch64 meets the architecture requirement. nproc returning 4 meets the CPU requirement. A total of 3.7Gi is only about 4.0 GB, so memory is insufficient. Passing two checks cannot compensate for failing the third.

Linux gives hardware devices names under /dev and publishes its device view under /sys. Several listing tools answer different questions: which storage devices exist, which buses detected devices, and which drivers are handling them.

Identify disks and partitions

SATA, SAS and USB disks commonly appear as /dev/sda, /dev/sdb and later letters. Their partitions add a number, such as /dev/sda1. NVMe uses names such as /dev/nvme0n1, with /dev/nvme0n1p1 for a partition. A virtual machine may use /dev/vda.

lsblk shows block devices as a tree. TYPE distinguishes a disk from a partition; RM marks removability and RO marks read-only status. SIZE gives capacity and MOUNTPOINTS shows where a device is in use. Choose extra detail with:

lsblk -o NAME,SIZE,MODEL
lsblk -f

The first makes model and size easy to compare. The second adds file system type, label and UUID. Names such as sdb can change with detection order. Before writing to a disk, confirm its identity by more than the letter: writing to the wrong device destroys its data.

A drive sold as 512 GB contains 512 billion bytes. In GiB that is about 476.8, which lsblk displays as 476.8G. The device has not lost capacity: its label and the display use different units.

Find devices and bound drivers

A USB ID such as 046d:c52b identifies the vendor and product more reliably than a broad name like "wireless receiver." In PCI output, distinguish Kernel modules, which names possible modules, from Kernel driver in use, which identifies a bound driver. Detection alone is not the same as working support.

Most drivers can be loaded as kernel modules, pieces of kernel code added when needed. Loading or removing modules changes the running kernel and requires root authority. Some drivers are built into the kernel instead. On ARM boards, many built-in devices do not sit on PCI, so a short lspci listing need not mean hardware is missing.

Follow a connection in the kernel log

When a USB disk is plugged in, run sudo dmesg | tail, or start sudo dmesg -w before connecting it. A message such as [sdb] 60437492 512-byte logical blocks identifies the new disk as /dev/sdb and gives its capacity. Multiplying those block counts gives 30,943,995,904 bytes: about 30.9 GB or 28.8 GiB.

Then compare the new lsblk entry with that message and the device model. If a detected adapter fails to work, use lspci -k to check the driver and dmesg to read initialization errors. A missing driver binding and a driver that reports an error require different follow-up checks.

A package bundles software files with information used to install and maintain them. Its metadata names the version, architecture and required packages, and it can include installation scripts. A package manager records which files belong to which installed package.

Match the distribution family

Arch Linux uses pacman; Alpine Linux uses apk. The older yum name belongs to the Red Hat family. If you are unsure which system you have, read cat /etc/os-release before choosing commands.

A file such as nginx_1.24.0-2_amd64.deb names nginx, its software version, packaging revision and architecture. These fields help the package manager select a compatible build. A familiar application name does not make every downloaded package suitable for every distribution.

Let the high-level tool resolve dependencies

A dependency is another package needed by the software, often a shared library. Installing one application may therefore add several packages. A high-level tool such as apt or dnf finds a compatible set, downloads it and asks the lower-level tool to install it.

dpkg and rpm work with local package files and maintain the installed-package database. They do not fetch missing dependencies from repositories. Using them to install a file can leave missing requirements for you to resolve. High-level tools can install local files too, while resolving their requirements from configured repositories.

Searching and querying work as a regular user. Installation, removal and upgrades change system files and normally need sudo. The confirmation screen is useful information: inspect the additional packages and any proposed removals before accepting.

Understand repository trust

A repository provides package files and indexes describing the available versions and dependencies. A distribution's own repositories offer a set built for its release.

APT verifies signed repository metadata and follows package checksums from that metadata to the downloaded files. It does not normally check a separate signature on each .deb. DNF normally verifies distribution RPM signatures; repository-metadata signature checking is configured separately. These checks establish a chain to a trusted publisher and help detect tampering.

Adding a third-party repository also adds trust in that publisher's software and installation scripts. Obtain its signing key through the publisher's genuine instructions. Do not bypass signature checks to get past an error such as "NO_PUBKEY". A file from an unknown download page also needs a trustworthy origin; the package extension alone supplies no such trust.

Search by the right name

Software and package names can differ. Apache is packaged as apache2 on Debian-family systems and httpd on Red Hat-family systems. The dig command comes from bind9-dnsutils or bind-utils. Search before assuming that a command name is also its package name.

Other installation systems keep separate records. Snap, Flatpak and AppImage bundle applications with many dependencies; pip and npm manage programming libraries. Installing a Python library with pip does not make it an apt-managed package.

Package maintenance has three separate jobs: learn what is available, apply selected changes and remove software that is no longer needed. Read the planned transaction before confirming, especially when it removes packages.

Refresh and upgrade

apt update does not upgrade software. It downloads current package lists. Follow it with sudo apt upgrade to install newer versions. DNF's upgrade command handles stale repository metadata as part of its work. DNF4 uses dnf check-update to list available changes; DNF5 uses dnf check-upgrade.

apt upgrade will not remove an installed package to complete an upgrade. A package needing such a change may be held back. sudo apt full-upgrade permits removals, so inspect its plan carefully. -y accepts a transaction automatically and removes your opportunity to review it interactively.

Install from a repository or a local file

On Ubuntu, run sudo apt update, then sudo apt install htop. APT lists new packages and dependencies before downloading them. htop --version checks the installed program. On Fedora, use sudo dnf install htop.

Running apt install for an existing package can upgrade it to the current candidate; it changes nothing if that version is already installed. To install a trusted local file, name its path:

sudo apt install ./app_2.1.0_amd64.deb
sudo dnf install ./app-2.1.0-1.x86_64.rpm

The ./ marks a file path. In contrast, sudo dpkg -i file.deb and sudo rpm -i file.rpm do not fetch missing dependencies. If dpkg leaves dependencies unsatisfied, sudo apt --fix-broken install can resolve them; inspect the proposed repair.

Remove software and settings deliberately

APT's remove retains the package's managed system configuration; purge removes that too. Neither removes files from users' home directories. Autoremove targets automatically installed dependencies no longer needed by installed packages. It is a different decision from removing one application by name.

APT source entries live in /etc/apt/sources.list and /etc/apt/sources.list.d/; Ubuntu 24.04 commonly uses ubuntu.sources in that directory. Refresh after changing sources. DNF reads .repo files under /etc/yum.repos.d/; dnf repolist shows enabled repositories.

Finish maintenance cleanly

apt is designed for interactive use. Scripts generally use the more stable interfaces of apt-get and apt-cache. Their commands cover the same broad tasks, although defaults can differ.

A newly installed kernel becomes the running kernel after reboot. Programs using replaced libraries need restarting to load the new code. Ubuntu can indicate a needed reboot with /var/run/reboot-required.

A package lock often means an automatic update or another package operation is active. Wait for it to finish; deleting the lock file can damage package records. A permission error instead points to missing authority, so confirm whether the operation needs sudo.

When a command is missing or a version changes, package queries let you work backward from the symptom. Start by deciding whether you need repository information, installed-package information or the owner of a particular file.

Search before installing

apt search json and dnf search json look through package names and descriptions. Inspect a promising result with apt show NAME or dnf info NAME. These show details such as version, size, description and repository. APT's show output also lists dependencies; DNF requirements can be queried with dnf repoquery --requires NAME.

Repository information answers what you could install. It does not alone establish what is already installed. apt policy NAME distinguishes the installed version from the candidate, the version APT would currently select. apt list --upgradeable or dnf list --upgrades shows installed packages with available updates.

Query installed records

In dpkg -l, the status ii identifies an installed package. The direction of a query matters: -L starts with a package and lists its files; -S starts with a file and finds its owner. On RPM systems, the parallel distinction is -ql versus -qf.

Trace a command to its package

Suppose which openssl prints /usr/bin/openssl. On Debian, dpkg -S /usr/bin/openssl identifies the owning package as openssl. apt policy openssl then shows the installed version, candidate and repositories. This avoids assuming the command's name must always match its package.

For a missing command, there may be no installed owner to query. dnf provides /usr/bin/rsync searches repository file lists. Debian-family systems offer the separate apt-file tool: after its index is refreshed with sudo apt-file update, apt-file search bin/rsync finds providers. Ubuntu may also suggest a package when a command is not found.

Connect a fault with a transaction

APT records transactions in /var/log/apt/history.log; dpkg records lower-level actions in /var/log/dpkg.log. On DNF4, dnf history lists transactions; DNF5 uses dnf history list. dnf history info 12 shows the packages changed in transaction 12.

sudo dnf history undo 12 requests reversal of that transaction. Review its plan: reversal depends on the needed package versions still being available and does not restore arbitrary application data. For diagnosis, read the history before making another change. A recent library upgrade may explain why a program's behavior changed even though nobody reinstalled the main application.

A service, often called a daemon, provides a background function such as serving web pages or accepting SSH connections. It usually has no terminal. Many daemon names end in d, as in sshd and chronyd.

Find the service manager

On most mainstream distributions, systemd runs as PID 1 and starts services in the required order. Check with ps -p 1 -o comm=. systemd can supervise processes, restart failed services and arrange their log collection. Some distributions use another manager, such as Alpine Linux's OpenRC.

systemd manages units. Their suffixes identify their roles:

In service commands, nginx is shorthand for nginx.service. Names vary: SSH commonly uses ssh on Debian and Ubuntu, and sshd on Fedora and RHEL. Apache is apache2 or httpd. systemctl list-unit-files | grep ssh helps find the local name.

Read the two important status lines

Run systemctl status nginx. An example can include:

Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-10-21 09:14:03 UTC
Main PID: 2410 (nginx)

Loaded names the unit file and its enablement state. Active reports the current state and when it began. Main PID identifies the principal process; recent log lines follow. A regular user can inspect status, but system log visibility can require additional privileges.

Active and enabled are independent. Active describes the present. Enabled means enablement links have been created, commonly so a target starts the service at boot. A disabled service can still be started manually or activated by another unit. An enabled service can be stopped or failed.

Interpret the state accurately

The color of the status dot helps scanning, but the state text is the useful evidence. systemctl is-active nginx reports the current state; systemctl is-enabled nginx reports enablement. static means the unit has no enablement instructions and can be activated through another route. masked means starting it is blocked.

Choose the right overview

systemctl list-units --type=service shows service units currently loaded, with its default state filtering. Add --all to include inactive loaded units, or --state=running to focus on running services. systemctl --failed isolates failed units. systemctl list-unit-files --type=service lists installed service files and enablement states, including services that are not running now.

Service control has two time scales: what should run now, and what should be started automatically later. Keep those decisions separate when installing software or repairing a service.

Control the current state

Use systemctl status nginx after a change. For a quiet check, systemctl is-active --quiet nginx returns success when it is active. It prints no state text, making it useful in shell conditions.

Reload support comes from the service. For nginx, test a changed configuration with sudo nginx -t before sudo systemctl reload nginx. A successful reload can apply new settings without stopping the service. With a broken configuration, nginx retains the old running configuration on reload; restarting with the broken file can instead leave it down.

Configure automatic startup

sudo systemctl enable nginx creates enablement links; it does not start nginx now. sudo systemctl disable nginx removes those links; it does not stop the current process. To make both changes together:

sudo systemctl enable --now nginx
sudo systemctl disable --now nginx

The first enables and starts; the second disables and stops. A Fedora installation of nginx commonly leaves it stopped and disabled, while Debian-family package installation often starts and enables it. Check the actual state after installation.

After starting a web service, curl -I http://localhost can check its local response. A local success and access from another machine are different tests; a firewall can still block remote access.

Block activation when necessary

Disabling does not prevent a dependency or socket from activating a service. Masking blocks startup by linking the unit name to /dev/null:

sudo systemctl mask bluetooth
sudo systemctl unmask bluetooth

Masking alone does not stop an already running unit. Stop it as well when it must cease running. Unmasking removes the block; it does not by itself start or enable the service. A masked unit's start attempt reports that it is masked.

Choose the default system state

A target groups units. multi-user.target provides the normal non-graphical multi-user environment, commonly used on servers. graphical.target adds the desktop. systemctl get-default reports the default target, and sudo systemctl set-default multi-user.target changes the target selected for future boots; it does not immediately close the current desktop.

sudo systemctl reboot restarts the machine and sudo systemctl poweroff shuts it down. For a single service, use its own control commands instead. Killing a managed service's PID can trigger an automatic restart; an intentional systemctl stop tells systemd to keep it stopped.

A unit file tells systemd how to run a service. Read the effective configuration with systemctl cat NAME: it prints the base file and any overrides with their paths.

Know where settings belong

Packaged units live under /usr/lib/systemd/system/, also reached as /lib/systemd/system/ on Debian-family systems. Local administrator files and overrides belong under /etc/systemd/system/, which has precedence. A package update can replace its own file, so keep local changes in an override.

A unit file has sections and Key=value settings:

After=network.target sets ordering; it does not itself start that target or promise Internet connectivity. WantedBy=multi-user.target tells enable to create a link under multi-user.target.wants/. A static unit has no enablement instructions but can still be activated by another unit.

Build a simple service

For a small test server, first prepare /srv/hello with readable files and a system account:

sudo useradd --system --no-create-home hello

With Python 3 installed at /usr/bin/python3, write /etc/systemd/system/hello-web.service:

[Unit]
Description=Hello web server
After=network.target

[Service]
ExecStart=/usr/bin/python3 -m http.server 8080 --directory /srv/hello
User=hello
Restart=on-failure

[Install]
WantedBy=multi-user.target

Run sudo systemctl daemon-reload, then sudo systemctl enable --now hello-web. Inspect systemctl status hello-web and request http://localhost:8080 with curl. The service account needs permission to read the directory and traverse its parent directories.

With the default Type=simple, the program stays in the foreground so systemd can track it. ExecStart= accepts an absolute executable path or a simple filename from systemd's search path. A relative path with a slash, such as ./server, is invalid. A program that forks into the background needs an appropriate service type such as Type=forking.

Override a packaged setting

sudo systemctl edit nginx opens a drop-in. For example:

[Service]
Restart=on-failure
RestartSec=5s

Saving through systemctl edit reloads systemd's unit configuration. Restart the service to apply changed runtime settings. When editing files directly, run sudo systemctl daemon-reload yourself before restarting. This reloads unit definitions, not the application's own configuration.

Replacing a list setting such as ExecStart requires an empty ExecStart= line before the new one. sudo systemctl revert nginx removes local overrides and restores the vendor configuration.

Restart=no leaves a finished process stopped. on-failure restarts after qualifying failures; always also covers clean exits. An intentional systemctl stop suppresses automatic restart. Rapid failures can hit a configured start-rate limit. The manager defaults allow five starts in 10 seconds; local configuration can change them. Fix the cause before clearing the failed state and trying again.

The systemd journal collects kernel, boot and service messages, including output sent to the journal by managed programs. systemd-journald stores indexed binary records. Read them with journalctl; a text-file reader such as less cannot interpret the journal files themselves.

Read enough of the record

System-journal access depends on permissions and local policy. Root and authorized groups such as systemd-journal or adm can read system entries. If a regular account sees only a limited set, use sudo journalctl for the system investigation.

The default view starts with old messages in a pager. Use arrow keys to move, / to search and q to quit. Choose a more focused view:

-n without a number selects ten entries. Status output often shows only a few recent lines, so read the journal when those lines do not explain the failure.

Combine unit, boot and time filters

sudo journalctl -u nginx -b selects nginx records from this boot. -b -1 selects the previous boot; --list-boots lists retained boot records. -k selects kernel messages and normally implies the current boot. For older kernel records, give the boot explicitly.

Time filters accept relative times and full dates:

sudo journalctl -u nginx --since "2026-10-22 08:00" --until "2026-10-22 09:30"

--since today means since midnight today, while --since "1 hour ago" gives a moving time window. Quoted date-time strings stay together as one argument. A date without a time starts at midnight.

Understand the priority cutoff

Priorities run from 0, emergency, to 7, debug. In between are alert, critical, error, warning, notice and information. Lower numbers are more severe. -p err includes levels 0 through 3, not just error. Use an explicit range such as -p err..warning to select that band.

A narrow severity filter can hide the evidence you need. For example, SSH can record failed-password messages at information level. On Ubuntu, sudo journalctl -u ssh --since today --grep "Failed password" finds matching messages without dropping them through a warning cutoff.

A line such as "Failed password for invalid user admin from 203.0.113.45" identifies the attempted account and source address. The timestamp and program PID place it in the surrounding activity. -o short-iso makes full dates easy to compare; -o verbose exposes fields, -o json-pretty prints structured records and -x adds available explanatory text.

Know what survives a reboot

Persistent journals live under /var/log/journal/; volatile journals under /run/log/journal/ disappear at shutdown. Storage behavior is controlled by Storage= in journald configuration. One recorded boot can mean older records were never persisted or have already been removed.

journalctl --disk-usage includes active and archived journal files. sudo journalctl --vacuum-size=500M removes old archived files toward a 500 MiB archived-file limit. Active files are not removed by that operation, so the total disk-usage report can remain larger.

The journal is not the only log source. Some systems also run rsyslog, and applications can write their own text logs. The kernel keeps a separate in-memory message buffer. Choose the source that recorded the event you are investigating.

Find the right text log

A file's presence depends on installed logging services and their configuration. Debian 12 and later commonly rely on the journal unless rsyslog is installed. Applications may still keep their own logs on such a machine.

Read a text file with sudo less /var/log/auth.log, inspect its end with sudo tail -n 20 /var/log/syslog, or follow arrivals with sudo tail -f /var/log/nginx/error.log. To select a word in any capitalization, use sudo grep -i "error" /var/log/syslog.

Read the fields and older files

A classic example is:

Oct 22 08:01:17 web1 sshd[3141]: Accepted publickey for alice from 198.51.100.7 port 50522 ssh2

It gives the time, host, program with PID, and event message. Some systems use full ISO timestamps with time-zone offsets instead. The message describes a successful key login, not a failed password attempt; reading only the program name loses that distinction.

Log rotation limits growth by renaming old files, creating new ones and eventually removing expired files. logrotate configuration lives in /etc/logrotate.conf and /etc/logrotate.d/. A sequence such as syslog, syslog.1 and syslog.2.gz spans current and older records. Use zless or zgrep for gzip-compressed text without extracting it first. A search of the current file alone can miss yesterday's fault.

Read kernel events

The kernel's ring buffer holds recent messages and overwrites its oldest entries as it fills. It records device detection, driver failures, storage errors and out-of-memory kills. dmesg prints it; use sudo when access is restricted. dmesg -T gives readable times, dmesg -l err,warn selects errors and warnings, and dmesg -w follows new messages.

sudo journalctl -k reads kernel entries retained by the journal. sudo journalctl -k -b -1 can reach a previous boot that the live ring buffer no longer holds.

If a Java process disappears, a kernel line such as "Out of memory: Killed process 4810 (java)" connects its exit to memory pressure. Check free -h and top, then reduce the memory demand or add capacity. For service startup problems, begin with the unit journal; for application-specific details, read its own error log.

Use rotation or journal retention controls to manage log space. Deleting a text log by hand removes evidence and may leave its disk space allocated until the writer closes the file.

Repeated restarts rarely explain a failure. Start with the visible symptom, collect the message that names its cause and change one thing. Then test the repaired service through both its manager and the function it provides.

Follow a repeatable investigation

1. Confirm the symptom: for example, a local web request fails.
2. Run systemctl status NAME and read Active, Result and the exit code.
3. Read sudo journalctl -u NAME -b, or the last 50 entries with -n 50 --no-pager.
4. Use the application's own error log and configuration test.
5. Correct one identified cause and repeat the relevant check.
6. Start or restart, inspect status and test the actual function.
7. Check systemctl is-enabled NAME against the intended boot behavior.

Read the first meaningful error in the failed attempt. A later "Failed to start" line summarizes the result; it may not name the cause. Keeping the time and unit filters aligned helps separate the latest attempt from older failures.

Work through a port conflict

An nginx restart fails. Its journal contains "bind() to 0.0.0.0:80 failed (98: Address already in use)." Something is already listening on that port. Run:

sudo ss -tlnp | grep ':80 '

Suppose it identifies apache2. If this machine is intended to use nginx and Apache is no longer required, sudo systemctl disable --now apache2 stops Apache and removes its enablement links. Then sudo systemctl start nginx can acquire the port. Check systemctl status nginx and a local web request.

The condition matters: do not remove a needed service merely to make a second one start. If both must run, their listening configuration needs a deliberate change. The log identifies the resource conflict, while the system's intended role determines the repair.

Work through a configuration error

Suppose the journal reports an unexpected closing brace in /etc/nginx/sites-enabled/default:24. Run sudo nginx -t; it identifies the same file and line. Correct the misplaced brace, run the test again, and restart only after the test succeeds. This isolates the change and avoids replacing a known running configuration with a broken one.

Use the result code to narrow the search

A missing executable and a program that starts but rejects its settings are different failures. For "Permission denied," compare ls -l output and directory access with the service's configured user. For a full disk check df -h; for low RAM check free -h; for CPU pressure inspect top.

If systemd reports "start request repeated too quickly," first repair the cause. Then sudo systemctl reset-failed NAME clears the failure and start-limit counters so you can start it again. Resetting the counter alone does not repair the program.

An archive bundles files and directories with their names and metadata. Compression reduces the bytes needed to store data. A plain tar archive bundles files without compressing them; adding a compressor produces files such as .tar.gz, .tar.bz2 or .tar.xz.

Read the options as a small sentence

GNU tar also accepts combined options and the older no-dash style. With a combined group, keep f last and put its filename next. The uppercase J selects xz; lowercase j selects bzip2.

Create an archive with useful member names

tar -czvf site-backup.tar.gz -C /var/www site

This creates site-backup.tar.gz in the shell's current directory. Tar changes its input location to /var/www, then adds site, so stored names begin site/. It preserves directory structure, modes, ownership metadata and timestamps.

Giving /var/www/site directly also works. GNU tar normally strips the leading slash and stores var/www/site/...; extraction then rebuilds that path beneath the destination. Choosing the input directory with -C gives a shorter, more convenient restore layout.

List before restoring

Run tar -tzvf site-backup.tar.gz. It lists names and metadata without extracting. Check whether all members sit beneath one directory. If not, extracting can scatter files across the destination. GNU tar detects common compression formats when reading, so tar -tvf site-backup.tar.gz also works.

To restore into an existing empty directory:

tar -xzvf site-backup.tar.gz -C /tmp/restore

The destination must already exist. Extraction can overwrite files with matching names, so use an empty restore directory when checking an unfamiliar archive. To extract one member, name it exactly as listed: tar -xzvf site-backup.tar.gz site/index.html.

Protect the archive filename and metadata

The word after -f is the archive filename. In tar -cfz backup.tar.gz docs, tar treats z as that filename and the later words as inputs. Similarly, tar -cf *.txt lets shell expansion choose the first text file as the output archive and can overwrite it. Always name the archive explicitly.

A regular user restores files under their own ownership; root can restore recorded owners. Creating a backup requires read access to the source. For protected system files, use an authorized command such as sudo tar -czf /root/etc-2026-10-22.tar.gz /etc, and check its errors for omitted files.

--exclude='*.log' omits matching paths. GNU tar's -a selects a compressor from the suffix, as in tar -caf backup.tar.xz docs. Before removing originals, read the archive with tar -tzf backup.tar.gz > /dev/null and confirm that the listing contains the expected files. A successful read checks readability; inspecting a restore also checks that the chosen contents are useful.

Compression tools differ in speed, size and how they handle originals. Choose a format based on the job: a quick log reduction, a Linux backup or a download for users on several operating systems.

Compress a file and keep the original when needed

These tools normally replace an input file with its compressed version. gzip access.log leaves access.log.gz and removes the original after success. Add -k to keep it. Their -d forms reverse the operation.

They do not build a multi-file directory archive. gzip project refuses a directory; recursive gzip compresses its files individually. To preserve a directory tree as one compressed object, create a tar archive with the chosen compressor.

Balance time, memory and size

Gzip is usually fast, xz often makes smaller files at a greater time and memory cost, and bzip2 commonly lies between them. Results depend on the input and settings. Levels from -1 to -9 favor speed at the low end and compression at the high end. Defaults are 6 for gzip and xz and 9 for bzip2.

Text logs often shrink greatly. JPEG images, MP4 video and compressed archives usually gain little from another pass. Recompressing them can spend CPU time without a useful space saving.

For one sample of 240 MiB of logs, gzip produced 31 MiB and xz 22 MiB. Those outputs retain about 12.9% and 9.2% of the original size. The smaller file comes with a longer compression run in that sample; the figures are not predictions for other data.

Read and test compressed content

zcat, zless and zgrep read gzip-compressed text; bzcat and xzcat handle their respective formats. For example, zgrep "error" /var/log/syslog.2.gz searches a rotated log without leaving an uncompressed copy on disk.

Use gzip -t file.gz or xz -t file.xz for integrity checks. A suffix is only a naming convention: file backup.bin can identify gzip content even without .gz. sha256sum backup.tar.gz produces a checksum for comparison after transfer. Matching checksums show that the copies match, not that every wanted source file was included.

Share a directory with zip

ZIP bundles and compresses while keeping the source files:

zip -r project.zip project
unzip -l project.zip
unzip project.zip -d /tmp/project

-r includes the directory's contents recursively. unzip -l lists them; -d chooses the extraction destination. The commands may need installation first. ZIP is convenient for Windows and macOS users. Linux ZIP tools can store Unix metadata, but restoring ownership and modes across other systems is less portable than using tar for a Linux backup.

Choose .tar.gz for a routine Linux backup, .tar.xz when reducing a download matters more than compression time, .zip for broad desktop sharing and gzip for one large text file. Keep source files until checks and a trial restore establish that the archive contains what you need.