Automated Service Monitoring with systemctl

Updated: 2025-11-17

Automated Service Monitoring with systemctl

This guide covers automated service monitoring: get alerted when critical services stop, without manually checking systemctl status.

For quick manual service checks, see Quick Service Status Check.

Why Automate Service Monitoring?

Services can stop unexpectedly due to:

Out of memory (OOM killer)
Configuration errors after changes
Disk full preventing log writes
Bugs causing crashes
Dependency failures

Without monitoring, you discover problems when users complain.

Setting Up Service Alerts

Command for Zuzia.app

# Check if nginx is running (returns 0 if running, 3 if stopped)
systemctl is-active nginx

# For alerting, use this pattern:
systemctl is-active nginx || echo "ALERT: nginx is not running"

Multiple Services

# Check multiple critical services at once
for svc in nginx mysql redis; do
  systemctl is-active $svc > /dev/null || echo "ALERT: $svc is down"
done

Which Services to Monitor

Priority	Services	Check Frequency
Critical	nginx, apache, database	Every 1 min
High	redis, memcached, php-fpm	Every 2 min
Medium	cron, ssh, postfix	Every 5 min

Method 1: List Running Services with systemctl Command

The systemctl command is the standard way to manage and check systemd services on modern Linux systems.

List All Running Services

To see all currently running services:

# List all running services
systemctl list-units --type=service --state=running

This shows:

Service names
Service status (active/running)
Service descriptions
Load status

List All Services (Including Stopped)

To see all services including stopped ones:

# List all services
systemctl list-units --type=service --all

This provides a complete view of all services and their states.

Check Specific Service Status

To check if a specific service is running:

# Check if nginx is running
systemctl is-active nginx

# Check if mysql is running
systemctl is-active mysql

# Check multiple services
systemctl is-active nginx mysql redis

This returns "active" if running, "inactive" if stopped, or "failed" if the service has failed.

Method 2: Check Service Status with systemctl status

The systemctl status command provides detailed information about services.

Detailed Service Status

# Detailed status of a service
systemctl status servicename

# Status with no pager
systemctl status servicename --no-pager

This shows:

Current service state
Process ID (PID)
Recent log entries
Service dependencies
Memory and CPU usage
Service start time

Method 3: Check Running Services with service Command

On older systems or for compatibility, use the service command:

# Check service status
service servicename status

# List all services (if available)
service --status-all

This provides compatibility with older init systems.

Method 4: Automated Running Service Monitoring with Zuzia.app

Checking services by hand works while you are logged in. Zuzia's agent keeps an eye on them when you are not.

How it works in Zuzia

Install the Zuzia agent on the server with one command. Zuzia discovers the systemd services on the host and shows their state.
Start, stop or restart any discovered service from the panel, without opening an SSH session.
Pick the services that matter and choose what happens when one stops: Zuzia only notifies you, or Autopilot (paid plans) restarts it and checks it came back. You can run Autopilot in dry-run first, or approve each restart from a link in your email.
For checks beyond systemd, save the commands from this guide as a scheduled task. If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).

Setting it up

Add the server in the Zuzia dashboard and install the agent.
Open the host's Services tab, pick the services to watch and choose notify or Autopilot.
Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.

Method 5: Advanced Service Monitoring Techniques

Monitor Specific Critical Services

To monitor specific critical services:

# Check web server services
systemctl is-active nginx
systemctl is-active apache2

# Check database services
systemctl is-active mysql
systemctl is-active postgresql

# Check cache services
systemctl is-active redis
systemctl is-active memcached

This helps ensure critical services are always running.

Compare Service Lists Over Time

By storing service lists in Zuzia.app, you can compare current running services with previous lists to detect new services or stopped services.

Detect Failed Services

To identify services that have failed:

# List failed services
systemctl --failed

# Check for failed services
systemctl list-units --type=service --state=failed

Failed services require immediate attention as they indicate problems.

Real-World Use Cases for Service Monitoring

Critical Service Availability

Monitor critical services to ensure availability:

# Check critical services
for service in nginx mysql redis; do
  if systemctl is-active $service >/dev/null 2>&1; then
    echo "$service is running"
  else
    echo "ALERT: $service is not running"
  fi
done

Set up Zuzia.app to check critical services every 5 minutes and alert immediately if any stop.

Unauthorized Service Detection

Detect unauthorized services:

# Compare current services with baseline
systemctl list-units --type=service --state=running --no-pager | awk '{print $1}' | sort > /tmp/current-services.txt
diff /tmp/baseline-services.txt /tmp/current-services.txt

Set up Zuzia.app to check services regularly and alert when unexpected services are detected.

Service Health Monitoring

Monitor service health over time:

# Count running services
systemctl list-units --type=service --state=running --no-pager | wc -l

# Track service count trends

Use Zuzia.app's historical data to track service availability trends.

Best Practices for Service Monitoring

1. Monitor Services Regularly

Check running services at least every 15-30 minutes for active monitoring. Less critical systems can be checked every hour. Use Zuzia.app automated monitoring to ensure regular checks.

2. Track Service Status Changes

Use Zuzia.app's historical data to track service status changes over time. Understanding when services stop or start helps detect problems early.

3. Monitor Critical Services More Frequently

Monitor mission-critical services more frequently (every 5-15 minutes) than less critical services. Set up dedicated monitoring tasks for critical services.

4. Maintain Baseline Service List

Maintain a baseline list of expected running services. Compare current services with baseline to detect unauthorized services quickly.

5. Review Audit Results Promptly

Review service monitoring results promptly and investigate any stopped critical services immediately. Service failures can cause system-wide problems.

Troubleshooting Common Service Monitoring Issues

Services Not Showing

If services are not showing:

Check systemd is running: systemctl status
Verify command syntax: Ensure systemctl command is correct
Check permissions: Some commands require root privileges
Verify service exists: systemctl list-unit-files | grep servicename

Service Stopped Unexpectedly

If a service stops unexpectedly:

Check service status: systemctl status servicename
Review service logs: journalctl -u servicename -n 50
Check dependencies: systemctl list-dependencies servicename
Restart service: systemctl restart servicename

Unexpected Services Running

If unexpected services are detected:

Identify the service: systemctl status servicename
Verify if service is authorized
Check when service was started: systemctl show servicename -p ActiveEnterTimestamp
Investigate potential security breach

FAQ: Common Questions About Monitoring Running Services

How often should I check running services on Linux?

We recommend checking running services every 15-30 minutes for active monitoring. Use Zuzia.app automated monitoring to check services continuously without manual intervention. Less critical systems can be checked every hour.

What should I do if a critical service stops running?

If a critical service stops, immediately investigate: check service status and logs, verify dependencies, restart the service if appropriate, and investigate root cause to prevent recurrence. Use Zuzia.app to monitor the service and receive alerts when it stops again.

Can I monitor specific services only?

Yes, you can modify commands to check specific services: systemctl is-active nginx mysql redis for multiple services, or create dedicated monitoring tasks for each critical service. This helps focus monitoring on important services.

How can I see service status changes over time?

Zuzia.app stores all service status data historically in its database, allowing you to view service status changes over time. You can see historical data showing which services were running on different dates, identify when services stopped or started, and track service availability trends.

What's the difference between active and running service status?

"Active" means the service is enabled and configured, while "running" means the service process is currently executing. A service can be active but not running (configured but stopped), or running but not active (process running but not managed by systemd).

Can I monitor services across multiple Linux servers?

Yes, Zuzia.app allows you to add multiple servers and monitor running services across all of them simultaneously. Each server executes service check commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and comparison.

Does Zuzia.app use AI to analyze service patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.

Automated Service Monitoring with systemctl