Guides

How to Troubleshoot with systemctl and journalctl

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Troubleshoot failed services with systemctl and journalctl on Amazon Linux and Ubuntu — status, logs, safe restart.

Language: English · मराठी · हिंदी

Why systemctl and journalctl

When nginx dies at 1 a.m. on an EC2 box serving a Delhi customer site, guessing wastes time. systemd gives status; the journal gives reasons.

Why: Structured service control beats random kill. What: is-active, status, journalctl filters, safe restart. How: Practice the card below on a lab VM.

Concept 1: Ask systemd for state

Why: You need a clear active/failed word. What: is-active, status, --failed. How: Start every outage here.

Example 1: Is service active?

Type this:

systemctl is-active nginx 2>/dev/null || echo inactive-or-missing

You will see:

inactive-or-missing

What it means: active / inactive / failed are the words to learn.

Example 2: Full status

Type this:

systemctl status nginx --no-pager -l 2>&1 | head -n 5 || true

You will see:

Unit nginx.service could not be found.
...

What it means: Status shows load state and last lines.

Example 3: List failed

Type this:

systemctl --failed --no-pager

You will see:

0 loaded units listed
...

What it means: Start triage with --failed on big hosts.

Concept 2: Read the journal

Why: Status alone hides the error line. What: journalctl -u, -b, -p, -f. How: Filter to the unit.

Example 4: Unit logs

Type this:

journalctl -u nginx -n 20 --no-pager 2>&1 | head -n 5 || true

You will see:

-- No entries --
...

What it means: -u selects one unit.

Example 5: Since boot

Type this:

journalctl -b -p err --no-pager 2>&1 | head -n 3 || true

You will see:

-- No entries --
...

What it means: -p err filters priority.

Example 6: Follow mind-set

Type this:

printf '%s\n' 'journalctl -u nginx -f   # Ctrl+C to stop'

You will see:

journalctl -u nginx -f   # Ctrl+C to stop

What it means: -f follows like tail -f.

Concept 3: Restart safely

Why: Blind restart can loop the failure. What: restart vs reload; is-enabled. How: Fix cause first.

Example 7: Restart safely

Type this:

printf '%s\n' 'sudo systemctl restart nginx' 'sudo systemctl is-active nginx'

You will see:

sudo systemctl restart nginx
sudo systemctl is-active nginx

What it means: Restart only after reading logs.

Example 8: Reload vs restart

Type this:

printf '%s\n' 'reload = pick new config if supported' 'restart = stop then start'

You will see:

reload = pick new config if supported
restart = stop then start

What it means: Prefer reload for nginx config when possible.

Example 9: Enable on boot

Type this:

systemctl is-enabled nginx 2>/dev/null || echo disabled-or-missing

You will see:

disabled-or-missing

What it means: enabled means starts at boot.

Concept 4: Distro notes and interview card

Why: Amazon Linux and Ubuntu both use systemd. What: same commands; journal group; outage card. How: Speak the five steps aloud.

Example 10: Amazon Linux note

Type this:

printf '%s\n' 'Amazon Linux 2023 uses systemd' 'journalctl same as Ubuntu'

You will see:

Amazon Linux 2023 uses systemd
journalctl same as Ubuntu

What it means: Commands transfer across both.

Example 11: Permission tip

Type this:

printf '%s\n' 'Need logs as normal user? ask for systemd-journal group'

You will see:

Need logs as normal user? ask for systemd-journal group

What it means: Do not use world-writable modes on journals.

Example 12: Outage card

Type this:

printf '%s\n' '1 status 2 journalctl -u 3 fix config 4 restart 5 verify curl'

You will see:

1 status 2 journalctl -u 3 fix config 4 restart 5 verify curl

What it means: Say this card in Infosys interviews.

Outage card (memorize)

1. systemctl status NAME
2. journalctl -u NAME -n 50 --no-pager
3. Fix config or disk
4. systemctl reload-or-restart NAME
5. curl or ss to verify

Suppose: Accenture-managed Ubuntu

nginx failed after config edit. journalctl shows duplicate listen. Fix and reload.

Suppose: Amazon Linux 2023 API host

App unit crash-loops. Logs show full disk. Clean logs, then restart.

Check yourself (quiz)

status → journalctl → fix → restart → verify. Never restart blind. Did you understand? Let us try it once more.