systemd 服务管理完全指南：从 systemctl 到自定义服务与定时任务 | 2026 最新实践

1
# 检查 systemd 是否是 PID 1
2
ps -p 1 -o comm=
3
# 输出: systemd
4

5
# 查看 systemd 版本
6
systemctl --version
7
# systemd 256 (256.x-1)
8

9
# 检查系统是否以 systemd 启动
10
if [ -d /run/systemd/system ]; then
11
    echo "systemd is running"
12
fi

1
# === 启动 / 停止 / 重启 ===
2
systemctl start nginx        # 启动服务
3
systemctl stop nginx         # 停止服务
4
systemctl restart nginx      # 重启服务（先停再启）
5
systemctl reload nginx       # 重新加载配置（不停服务）
6
systemctl try-restart nginx  # 仅在运行时才重启（未运行不启动）
7
systemctl reload-or-restart nginx  # 优先 reload，不支持则 restart
8

9
# === reload vs restart ===
10
# reload：服务进程不重启，只重新读取配置（零停机）
11
# restart：杀掉进程重新启动（有短暂中断）
12
# Nginx 支持 reload → 用 reload
13
# Python 脚本不支持 reload → 用 restart
14

15
# === 开机自启 ===
16
systemctl enable nginx       # 设置开机自启
17
systemctl disable nginx      # 取消开机自启
18
systemctl enable --now nginx # 设置开机自启并立即启动
19
systemctl disable --now nginx # 取消开机自启并立即停止
20

21
# enable 原理：创建符号链接
22
# /etc/systemd/system/multi-user.target.wants/nginx.service
23
# → /lib/systemd/system/nginx.service

1
# === 基础状态 ===
2
systemctl status nginx       # 详细状态（含最近日志）
3
systemctl is-active nginx    # 是否运行中 → active / inactive
4
systemctl is-enabled nginx   # 是否开机自启 → enabled / disabled
5
systemctl is-failed nginx    # 是否失败 → failed / success
6

7
# === 批量查看 ===
8
systemctl list-units --type=service              # 所有已加载的 service
9
systemctl list-units --type=service --state=running   # 运行中的服务
10
systemctl list-units --type=service --state=failed    # 失败的服务
11
systemctl list-unit-files --type=service              # 所有 service 文件
12
systemctl list-units --type=service --state=running | head -20  # 前 20 个
13

14
# === 查看依赖关系 ===
15
systemctl list-dependencies nginx       # nginx 依赖什么
16
systemctl list-dependencies --reverse nginx  # 谁依赖 nginx
17

18
# === 查看服务属性 ===
19
systemctl show nginx                    # 所有属性
20
systemctl show nginx -p ExecStart       # 启动命令
21
systemctl show nginx -p MainPID         # 主进程 PID
22
systemctl show nginx -p ActiveState     # 激活状态
23
systemctl show nginx -p MemoryCurrent   # 当前内存使用
24
systemctl show nginx -p CPUUsageNSec    # CPU 使用时间

1
$ systemctl status nginx
2

3
● nginx.service - The nginx HTTP and reverse proxy server
4
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
5
     Active: active (running) since Tue 2026-07-08 10:30:45 CST; 2h 15min ago
6
   Duration: 2h 15min 45s
7
       Docs: man:nginx(8)
8
   Main PID: 12345 (nginx)
9
      Tasks: 3 (limit: 4915)
10
     Memory: 5.2M (CPU peak: 8.1M)
11
        CPU: 320ms
12
     CGroup: /system.slice/nginx.service
13
             ├─12345 "nginx: master process /usr/sbin/nginx -g 'daemon off;'"
14
             └─12346 "nginx: worker process"
15

16
Jul 08 10:30:45 server systemd[1]: Starting The nginx HTTP and reverse proxy server...
17
Jul 08 10:30:45 server systemd[1]: Started The nginx HTTP and reverse proxy server.
18
Jul 08 10:35:20 server nginx[12345]: ... reload signal received

1
# === 系统电源管理 ===
2
systemctl poweroff          # 关机
3
systemctl reboot            # 重启
4
systemctl suspend           # 挂起（睡眠）
5
systemctl hibernate         # 休眠（写入磁盘）
6
systemctl hybrid-sleep      # 混合睡眠
7

8
# === 重新加载配置 ===
9
systemctl daemon-reload     # 重新加载所有 Unit 文件（改完 .service 必须执行）
10
systemctl daemon-reexec     # 重新执行 systemd 自身（极少用）
11

12
# === 重置失败状态 ===
13
systemctl reset-failed      # 清除所有 failed 状态
14
systemctl reset-failed nginx # 清除指定服务的 failed 状态
15

16
# === 切换运行目标 ===
17
systemctl isolate multi-user.target    # 切换到多用户模式（无图形界面）
18
systemctl isolate graphical.target     # 切换到图形界面模式
19
systemctl rescue                       # 进入救援模式
20
systemctl emergency                    # 进入紧急模式

1
# 查看当前默认目标
2
systemctl get-default
3
# 输出: multi-user.target
4

5
# 设置默认目标
6
systemctl set-default graphical.target
7
systemctl set-default multi-user.target
8

9
# 查看目标包含的服务
10
systemctl list-dependencies multi-user.target
11

12
# 临时切换目标
13
systemctl isolate rescue.target      # 进入救援模式
14
systemctl isolate emergency.target   # 进入紧急模式
15

16
# 查看所有 target
17
systemctl list-units --type=target
18
systemctl list-unit-files --type=target

1
# 网络相关
2
network.target          # 网络栈初始化（不代表网络已通）
3
network-online.target   # 网络真正可用（等待配置完成）
4
network-pre.target      # 网络配置前
5
network-manager.target  # NetworkManager 就绪
6

7
# 存储相关
8
local-fs.target         # 本地文件系统挂载
9
remote-fs.target        # 远程文件系统挂载
10
swap.target             # 交换分区
11

12
# 系统相关
13
basic.target            # 基础系统就绪
14
multi-user.target       # 多用户模式就绪
15
graphical.target        # 图形界面就绪
16

17
# 定时任务
18
timers.target           # 所有 timer 就绪

1
# === 按服务查看 ===
2
journalctl -u nginx                    # 查看 nginx 全部日志
3
journalctl -u nginx -u php-fpm         # 同时查看多个服务
4
journalctl -u nginx.service            # 完整名称
5

6
# === 实时跟踪 ===
7
journalctl -u nginx -f                 # 类似 tail -f
8
journalctl -f                          # 跟踪所有日志
9
journalctl -f -p err                   # 只跟踪错误级别
10

11
# === 按时间过滤 ===
12
journalctl --since today               # 今天的日志
13
journalctl --since yesterday           # 昨天的日志
14
journalctl --since "2026-07-08"        # 指定日期
15
journalctl --since "2026-07-08 10:00" --until "2026-07-08 12:00"
16
journalctl --since "1 hour ago"        # 1 小时前
17
journalctl --since "30 min ago"        # 30 分钟前
18

19
# === 按启动过滤 ===
20
journalctl -b                          # 当前启动的日志
21
journalctl -b -1                       # 上一次启动的日志
22
journalctl -b -2                       # 上上次启动
23
journalctl --list-boots                # 列出所有启动记录
24

25
# === 按优先级过滤 ===
26
journalctl -p err                      # 错误级别及以上
27
journalctl -p warning                  # 警告级别及以上
28
journalctl -p debug                    # 所有级别
29
journalctl -p 3                        # 用数字：0-7

1
# === 按可执行文件过滤 ===
2
journalctl /usr/bin/nginx              # nginx 进程的日志
3
journalctl /usr/sbin/sshd              # sshd 进程的日志
4

5
# === 按 PID 过滤 ===
6
journalctl _PID=12345
7

8
# === 按用户过滤 ===
9
journalctl _UID=1000                   # 指定用户的日志
10

11
# === 按控制组过滤 ===
12
journalctl _SYSTEMD_UNIT=nginx.service
13

14
# === 组合过滤 ===
15
journalctl -u nginx -p err --since today          # 今天 nginx 的错误
16
journalctl -u nginx -p warning --since "1h ago"   # 最近 1 小时的警告
17
journalctl -u docker --since today -n 50          # 今天 docker 最近 50 条
18

19
# === 输出格式 ===
20
journalctl -u nginx -n 20              # 最近 20 条
21
journalctl -u nginx --no-pager         # 不分页（适合管道）
22
journalctl -u nginx -o cat             # 只输出消息内容（无元数据）
23
journalctl -u nginx -o json            # JSON 格式
24
journalctl -u nginx -o json-pretty     # 美化 JSON
25
journalctl -u nginx -o verbose         # 详细字段
26
journalctl -u nginx --no-hostname      # 不显示主机名
27

28
# === 反向输出（最新在上） ===
29
journalctl -u nginx -r                 # 反向（最新在前）
30
journalctl -u nginx -rn 20             # 反向最近 20 条

1
# === 查看日志大小 ===
2
journalctl --disk-usage
3
# Archived and active journals take up 500M in the file system.
4

5
# === 清理日志 ===
6
# 按大小清理
7
journalctl --vacuum-size=100M          # 只保留最近 100M
8
journalctl --vacuum-size=500M
9

10
# 按时间清理
11
journalctl --vacuum-time=7d            # 只保留最近 7 天
12
journalctl --vacuum-time="2 weeks"
13

14
# 按文件数清理
15
journalctl --vacuum-files=3            # 只保留最近 3 个日志文件
16

17
# === 永久存储 ===
18
# 默认日志存在 /run/log/journal/（重启后丢失）
19
# 开启永久存储：
20
sudo mkdir -p /var/log/journal/
21
sudo systemctl restart systemd-journald
22

23
# === 配置 journald ===
24
sudo vim /etc/systemd/journald.conf

1
# 修改后重载
2
sudo systemctl restart systemd-journald

1
# === 排查服务启动失败 ===
2
systemctl status nginx              # 看状态和最近日志
3
journalctl -u nginx -b -p err       # 本次启动的错误日志
4
journalctl -u nginx --since "5 min ago"  # 最近 5 分钟
5

6
# === 排查系统启动慢 ===
7
systemd-analyze                     # 总启动时间
8
systemd-analyze blame               # 各服务启动耗时
9
systemd-analyze critical-chain      # 关键路径
10
systemd-analyze plot > boot.svg     # 生成启动时间线图
11

12
# === 排查 OOM（内存不足杀进程）===
13
journalctl -k -g "Killed process"   # 内核日志中搜索 OOM
14
journalctl --since today -p err | grep -i oom
15

16
# === 导出日志给他人分析 ===
17
journalctl -u nginx --since "1 hour ago" --no-pager > nginx-log.txt
18
journalctl -u nginx -o json-pretty > nginx-log.json

1
sudo vim /etc/systemd/system/myapp.service

1
# 创建用户和目录
2
sudo useradd -r -s /bin/false appuser
3
sudo mkdir -p /opt/myapp/data /var/log/myapp
4
sudo chown -R appuser:appuser /opt/myapp /var/log/myapp
5

6
# 部署服务
7
sudo systemctl daemon-reload
8
sudo systemctl enable --now myapp
9
sudo systemctl status myapp
10

11
# 查看日志
12
journalctl -u myapp -f

1
# 使用
2
sudo systemctl start myapp-docker    # docker compose up -d
3
sudo systemctl stop myapp-docker     # docker compose down
4
sudo systemctl reload myapp-docker   # docker compose restart

1
# 1. 验证 Unit 文件语法
2
systemd-analyze verify /etc/systemd/system/myapp.service
3

4
# 2. 重新加载
5
systemctl daemon-reload
6

7
# 3. 启动并查看状态
8
systemctl start myapp
9
systemctl status myapp
10

11
# 4. 检查日志
12
journalctl -u myapp -n 20 --no-pager
13

14
# 5. 设置开机自启
15
systemctl enable myapp
16

17
# 6. 验证开机自启
18
systemctl is-enabled myapp
19

20
# 7. 测试自动重启
21
systemctl kill myapp    # 杀掉进程
22
sleep 6                 # 等待 RestartSec
23
systemctl status myapp  # 应该自动恢复为 active

1
# 编辑服务的覆盖配置
2
sudo systemctl edit nginx
3

4
# 这会创建：
5
# /etc/systemd/system/nginx.service.d/override.conf
6

7
# 编辑器中写入覆盖内容：
8
[Service]
9
Restart=always
10
RestartSec=3s
11
LimitNOFILE=65536
12

13
# 保存后自动 reload
14
sudo systemctl daemon-reload
15
sudo systemctl restart nginx

1
# 场景1：给 Nginx 增加文件描述符限制
2
sudo systemctl edit nginx

1
# 场景2：让 Docker 不自动重启
2
sudo systemctl edit docker

1
# 场景3：修改 SSH 端口（不推荐改 service 文件，改 sshd_config 更好）
2
sudo systemctl edit sshd

1
# 场景4：给服务添加环境变量
2
sudo systemctl edit myapp

1
# 查看合并后的完整配置
2
systemctl cat nginx
3

4
# 查看实际生效的属性
5
systemctl show nginx -p Restart
6
systemctl show nginx -p LimitNOFILE

1
# 撤销 override
2
sudo systemctl revert nginx
3

4
# 或手动删除
5
sudo rm -rf /etc/systemd/system/nginx.service.d/
6
sudo systemctl daemon-reload
7
sudo systemctl restart nginx

1
# 启用
2
sudo systemctl daemon-reload
3
sudo systemctl enable --now backup.timer
4

5
# 查看 timer 状态
6
systemctl list-timers
7
systemctl list-timers --all
8
systemctl status backup.timer

1
# crontab 条目：
2
# 0 3 * * * /opt/scripts/backup.sh
3

4
# 迁移步骤：
5

6
# 1. 创建 service 文件
7
cat > /etc/systemd/system/backup.service << 'EOF'
8
[Unit]
9
Description=Backup Script
10

11
[Service]
12
Type=oneshot
13
ExecStart=/opt/scripts/backup.sh
14
User=backup
15
EOF
16

17
# 2. 创建 timer 文件
18
cat > /etc/systemd/system/backup.timer << 'EOF'
19
[Unit]
20
Description=Daily Backup
21

22
[Timer]
23
OnCalendar=*-*-* 03:00:00
24
Persistent=true
25

26
[Install]
27
WantedBy=timers.target
28
EOF
29

30
# 3. 启用
31
systemctl daemon-reload
32
systemctl enable --now backup.timer

1
# 查看所有 timer
2
systemctl list-timers
3
systemctl list-timers --all
4

5
# 输出示例：
6
# NEXT                        LEFT         LAST                        PASSED  UNIT           ACTIVATES
7
# Tue 2026-07-08 03:00:00 CST 16h remaining Mon 2026-07-07 03:00:01  8h ago  backup.timer   backup.service
8

9
# 查看特定 timer
10
systemctl status backup.timer
11
systemctl list-timers backup.timer
12

13
# 查看 timer 触发历史
14
journalctl -u backup.timer
15
journalctl -u backup.service

1
# 查看服务资源使用
2
systemctl show nginx -p MemoryCurrent -p CPUUsageNSec -p TasksCurrent
3

4
# 使用 systemd-cgtop 实时监控
5
systemd-cgtop
6
# 类似 top，但按 cgroup 分组
7

8
# 查看控制组
9
systemd-cgls
10
systemd-cgls nginx.service
11

12
# 查看资源限制配置
13
systemctl show nginx -p MemoryMax -p CPUQuota -p LimitNOFILE

1
# 使用 systemd-analyze security 检查安全分数
2
systemd-analyze security nginx
3

4
# 输出示例：
5
# → Overall exposure level for nginx.service: 4.2 OK ✓
6
#   ...
7
#   PrivateTmp=                      no       → 0.1
8
#   ProtectSystem=                   no       → 0.2
9
#   ...
10

11
# 检查所有服务
12
systemd-analyze security

1
# 启用
2
sudo systemctl enable --now myapp.socket
3
# 服务会在第一次连接时自动启动