6.6 Services and Logs: service, systemctl enable, journalctl
Class madhe vicharla jata: "Sir, Nginx install kela, reboot nantar site ka band?" Karan service start keli pan boot sathi enable keli nahi. Rojche kaam service ne, boot sathi systemctl enable.
| Command | Purpose |
|---|---|
sudo service nginx start |
Start now |
sudo service nginx stop |
Stop now |
sudo service nginx restart |
Stop and start again |
sudo service nginx reload |
Re-read config without dropping connections |
sudo service nginx status |
Is it running? Last log lines (press q to exit) |
service --status-all |
List services and their state (mostly on Ubuntu) |
Only systemd can do these:
| Command | Purpose |
|---|---|
sudo systemctl enable nginx |
Start automatically at every boot |
sudo systemctl disable nginx |
Do not start at boot |
systemctl is-active nginx / systemctl is-enabled nginx |
Quick yes/no checks (handy in scripts) |
systemctl list-units --type=service --state=running |
All running services |
sudo systemctl daemon-reload |
Reload systemd after creating or editing a .service unit file |
| Logs with journalctl: |
journalctl -u nginx # all logs of the nginx service
journalctl -u nginx -f # follow live (Ctrl+C to stop)
journalctl -u nginx --since "1 hour ago"
journalctl -p err -b # only errors since last boot
journalctl -u sshd -n 30 --no-pager # last 30 lines (service is 'ssh' on Ubuntu)
sudo journalctl --disk-usage
Logs on Amazon Linux 2023
Amazon Linux 2023 does not install rsyslog by default, so /var/log/messages and /var/log/secure may not exist. Use journalctl instead (or install rsyslog).
| Log (Ubuntu) | Log (Amazon Linux 2023) | Contains |
|---|---|---|
/var/log/auth.log |
journalctl -u sshd |
SSH logins, sudo usage |
/var/log/syslog |
journalctl |
General system messages |
/var/log/nginx/access.log |
/var/log/nginx/access.log |
Every web request |
/var/log/apache2/error.log |
/var/log/httpd/error_log |
Apache errors |
Why this matters for security
Logs are evidence. Attackers try to delete or edit them ("covering tracks"), which is why companies ship logs to a central SIEM (Part 11) as soon as they are written. Know where each log lives on both OSes.
Ravindra Bagale's Tip
Website band padli ki majhe pahile teen commands nehmi hech: sudo service <name> status, sudo tail -n 50 <error log> aani sudo ss -tlnp. Khup students direct Google kartat – pan uttar bahutek vela ithech lihilela asta. Hi savay laava.
Practice task
Install nginx, start it with service, enable it at boot, reboot the instance and confirm it is running. Then read its last 20 journal lines.