⚙️ Services and Monitoring¶

Understanding how Linux runs background services, records events and monitors system health.

Table of Contents¶

What is a Service?
Why Services Exist
What is a Daemon?
Services vs Applications
What is systemd?
Why systemd Exists
Service Lifecycle
systemctl
Common systemctl Commands
What is Logging?
Why Logs Matter
journald
journalctl
Common journalctl Commands
Cron
Why Automation Matters
Monitoring
Resource Monitoring
Monitoring Tools
Common Monitoring Commands
Troubleshooting Mindset
Mental Model

1️⃣ What is a Service?¶

A service is a program that runs in the background.

Unlike normal applications, services usually operate without direct user interaction.

Examples:

SSH Server
Database Server
Web Server

Think of a service as:

A worker operating behind the scenes

2️⃣ Why Services Exist¶

Many tasks must continue running even when nobody is actively using the system.

Examples:

Website Hosting
Remote Access
Database Management

These functions are provided by services.

3️⃣ What is a Daemon?¶

In Linux, a background process is often called a:

Daemon

Examples:

sshd
cron
systemd-journald

A daemon usually starts automatically and waits for work.

Think of a daemon as:

A service always on standby

4️⃣ Services vs Applications¶

Applications:

User opens them

Examples:

Browser
VSCode
Calculator

Services:

Start automatically

and continue running in the background.

Example:

Browser → User launches

SSH Service → Runs continuously

5️⃣ What is systemd?¶

systemd is one of the most important Linux components.

After Linux boots, systemd becomes responsible for managing the system.

Responsibilities include:

Starting services
Stopping services
Monitoring services
Managing dependencies
Collecting logs

Think of systemd as:

The operating system manager

6️⃣ Why systemd Exists¶

Before systemd, Linux distributions used different startup systems.

Managing services was often inconsistent.

systemd introduced:

✅ Standardization

✅ Faster startup

✅ Better service management

✅ Centralized logging

7️⃣ Service Lifecycle¶

A service typically follows:

Stopped
   ↓
Started
   ↓
Running
   ↓
Stopped

Some services restart automatically if they fail.

8️⃣ systemctl¶

systemctl is the command-line tool used to communicate with systemd.

Think of it as:

The remote control for services

9️⃣ Common systemctl Commands¶

Display service status:

systemctl status ssh

Start a service:

sudo systemctl start ssh

Stop a service:

sudo systemctl stop ssh

Restart a service:

sudo systemctl restart ssh

Enable automatic startup:

sudo systemctl enable ssh

List running services:

systemctl list-units --type=service

These examples are provided to explain concepts.

🔟 What is Logging?¶

Logs are records of events occurring on a system.

Think of logs as:

A system diary

Logs help answer questions such as:

What happened?
When did it happen?
Why did it happen?

1️⃣1️⃣ Why Logs Matter¶

Without logs:

Troubleshooting becomes guesswork

Logs help identify:

errors
crashes
failed logins
service failures
security incidents

1️⃣2️⃣ journald¶

journald is the logging service provided by systemd.

It collects events from across the operating system.

Examples:

Service messages
Startup events
Errors
Warnings

Think of journald as:

The central log collector

1️⃣3️⃣ journalctl¶

journalctl is used to read logs managed by journald.

Think of it as:

A search tool for system events

1️⃣4️⃣ Common journalctl Commands¶

Display recent logs:

journalctl

Display logs for a service:

journalctl -u ssh

Display latest entries:

journalctl -n 50

Display logs from current boot:

journalctl -b

These commands help administrators investigate problems.

1️⃣5️⃣ Cron¶

Cron is Linux's scheduling system.

It allows commands and scripts to run automatically.

Examples:

Backups
Monitoring
Reports
Maintenance tasks

Think of cron as:

A task scheduler

1️⃣6️⃣ Why Automation Matters¶

Many administrative tasks repeat regularly.

Without automation:

Humans must remember everything

Automation improves:

consistency
reliability
efficiency

1️⃣7️⃣ Monitoring¶

Monitoring means observing system health.

Administrators monitor:

CPU usage
Memory usage
Disk usage
Network activity
Running services

Monitoring answers:

Is the system healthy?

1️⃣8️⃣ Resource Monitoring¶

Important resources include:

CPU¶

Processing power.

Memory¶

RAM usage.

Storage¶

Disk capacity.

Network¶

Traffic and connectivity.

Problems often appear first in monitoring data.

1️⃣9️⃣ Monitoring Tools¶

Linux provides many monitoring tools.

Examples:

top
htop
free
df
uptime

Each focuses on a different aspect of system health.

2️⃣0️⃣ Common Monitoring Commands¶

View running processes:

top

Display memory usage:

free -h

Display disk usage:

df -h

Display system uptime:

uptime

Display process information:

ps aux

These commands provide insight into system performance.

2️⃣1️⃣ Troubleshooting Mindset¶

When something breaks, administrators usually ask:

Is the service running?
What do the logs say?
Is the system overloaded?
Did anything change recently?

Common troubleshooting flow:

Problem
   ↓
Check Service
   ↓
Check Logs
   ↓
Check Resources
   ↓
Find Cause

Good troubleshooting relies on evidence rather than guesses.

2️⃣2️⃣ Mental Model¶

Imagine a city.

Services are:

Workers

Daemons are:

Workers always on duty

systemd is:

The city manager

journald is:

The city recorder

journalctl is:

The archive search system

cron is:

The scheduler

Monitoring tools are:

Security cameras

Final Mental Image

systemd
    ↓
Services
    ↓
Logs
    ↓
Monitoring
    ↓
Troubleshooting

Understanding these concepts is essential for maintaining healthy Linux systems.