3

I'm using RHEL 7, and would like to know if and when a particular service 'myservice.service' went inactive. Unfortunately, using:

journalctl -u myservice.service

only seems to show output from my actual service, but at some point, the output stopped, and I don't know if that's due to:

  1. the service being shut down, or
  2. systemd still considering the service to be active, but the actual process itself was just no longer generating output due to a problem with the underlying code

Is there any way to basically get a log of systemctl status events?

  • You might also consider third-party service monitoring (Nagios among many other options) to check and report on what is up when. – thrig Jul 20 '17 at 16:01
0

You can check for information in the system logs.

on redhat:

/var/log/messages 

on debian based distributions :

/var/log/syslog

You should also look for the logs of your particular service, it could be into something like

/var/log/<yourservice>.log

All those log are rotated so you can find older information inside the .log.1 ans .log.x.gz (you have to gunzip those, or use zless or vi)

Good search

  • Thanks! Didn't realize rsyslog service was running, so I do have access to /var/log/messages and the rotated, older logs. This should get me what I need. – user241654 Jul 20 '17 at 15:27
0

How to know exactly when a Linux service went inactive?

systemd does not appear to log when a service exits with status 0 and goes to "inactive (dead)" - this differs from the transitions when it fails, starts, or stops :(.

On Fedora 26, I get messages like systemd[1]: Started OpenBSD Secure Shell server. systemd[1]: Stopped OpenBSD Secure Shell server.

systemd does not necessarily log when sshd exits with exit status 0... which is what ssh and other daemons like apache tend to do for SIGTERM :(. SIGKILL shows up in journalctl -u: systemd[1]: ssh.service: Main process exited, code=killed, status=9/KILL.

On RHEL (like Fedora) though, you probably have audit enabled. This did the job for me

# journalctl --boot=-1 SYSLOG_IDENTIFIER=audit
...
Dec 30 13:51:38 localhost.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
...
Dec 30 13:52:08 localhost.localdomain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

fprintd is an example of a daemon which exits cleanly after an idle period, which is only logged as an audit message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.