Most Linux distributions are now managed by systemd, which is becoming more and more complex, but there are only so many common operations, so today I will talk about my own common operations and configuration.

Operation

daemon-reload

When adding a new service to a system, it is common to keep changing the test.service configuration file. After changing the configuration file, it is usually necessary to run systemctl daemon-reload to re-add the systemd configuration.

no-page

The service log is usually viewed using journalctl. However, when the log exceeds the maximum number of characters that can be displayed on the current line, the log is truncated by default, so you can use journalctl -u <service> --no-page to have the log automatically folded.

disk-usage

The systemd journal configuration file is at /etc/systemd/journald.conf, so if I want to see how much disk space a service’s journal is taking up, I can use the command journalctl -u <servie> --disk-usage.

poweroff

There are many shutdown commands under Linux, init , shutdown , poweroff, but if you have paid attention you will find the following facts.

1
2
3
4
5
6
7
8
9
root@localhost:~ 
 $ ll `which init`
lrwxrwxrwx. 1 root root 22 8月  22 2019 /usr/sbin/init -> ../lib/systemd/systemd
root@localhost:~ 
 $ ll `which poweroff`
lrwxrwxrwx. 1 root root 16 8月  22 2019 /usr/sbin/poweroff -> ../bin/systemctl
root@localhost:~ 
 $ ll `which shutdown`
lrwxrwxrwx. 1 root root 16 8月  22 2019 /usr/sbin/shutdown -> ../bin/systemctl

Yes, systemd works better. systemd determines the $0 name to execute the corresponding command, so we can execute systemctl poweroff to shut down the machine.

list-dependencies

systemd can specify the dependencies of a service, specified by the keywords After , Before , Requires, and the specific dependency path of the service is displayed via systemctl list-dependencies <service>.

Configuration

Restart

Most services are a resident process and we usually want to keep it running despite crashes, kills, abnormal interruptions, etc. So we can specify Restart=on-failure in [Servie] to accomplish this.

TimeoutStopSec

When stopping a service via systemctl stop, if the action specified in ExecStop takes a long time, we can set the timeout by adding TimeoutStopSec=10s.

RefuseManualStop

If there are services that we just want to keep up, or start automatically through a dependency, and do not want human intervention, then we can ensure that the service cannot be stopped manually by setting RefuseManualStop=true, e.g. rdma.service:.

1
2
3
[root@yiran 21:10:36 ~]$systemctl stop rdma
Failed to stop rdma.service: Operation refused, unit rdma.service may be requested by dependency only (it is configured to refuse manual start/stop).
See system logs and 'systemctl status rdma.service' for details.

PartOf

is similar to Requires=, except that it only acts on the stopping or restarting of a unit. The implication is that when a unit listed here is stopped or restarted, the unit itself is also stopped or restarted at the same time. Note that this dependency is unidirectional and that the stopping or restarting of the unit itself does not affect the units listed here.

If a.service contains PartOf=b.service, then this dependency will appear as ConsistsOf=a.service in the property list of b.service. That is, you cannot set the ConsistsOf= dependency directly.

@

Anyone who has configured openvpn on Linux will have seen examples of [openvpn@client.service](mailto:%60openvpn@client.service) such as.

If you need to start OpenVPN automatically at system boot, you can configure it by enabling openvpn@.service on the corresponding machine for both server and client. For example, if the client configuration file is /etc/openvpn/client.conf, the service name should be openvpn@client.service. Or, if the server-side configuration file is /etc/openvpn/server.conf, the service name would be openvpn@server.service.

Let’s look at the corresponding systemd configuration file.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
yiran@t480:~/Downloads 
 $ cat /lib/systemd/system/openvpn@.service

[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
After=network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
KillMode=process
ExecReload=/bin/kill -HUP $MAINPID
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
LimitNPROC=100
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target