Field Notes

01 / Unix

Read before you restart.

A quiet service is not always a healthy service. Start with a few observations you can compare.

2 MIN READ · A PRACTICAL FIELD NOTE

Restarting can clear the symptom and the most useful evidence at the same time. On a machine using systemd, these read-only commands make a useful first pass. Replace example.service with the unit you are investigating.

Find the current state

systemctl status example.service --no-pager
systemctl show example.service -p ActiveState -p SubState -p MainPID

The active state tells you what the service manager believes. It does not prove that a user request can complete. Keep the two questions separate.

Give the logs a boundary

journalctl -u example.service --since "30 minutes ago" --no-pager
journalctl -u example.service -b -p warning --no-pager

A time window helps connect a report with the relevant events. The second command narrows the current boot to warning-priority messages and anything more severe. Access may require additional permissions.

Check the listening socket

ss -lnt
ss -lnu

Confirm the expected protocol and port. A listening socket is another observation, not an end-to-end test. Finish with a request that exercises the actual service.

Further reading: The journalctl manual.

All notes