systemd services with systemctl: start, enable, mask and drop-ins

Everything here runs on rocky01 as student with sudo, on chronyd, the service that keeps the clock right. Stopping it for a few minutes does no harm in the lab, and at the end you’ll put it back the way the installer left it. Take a VirtualBox snapshot first if you like (VBoxManage snapshot rocky01 take before-l26 on the laptop).

On ubu01 use the name chrony wherever you see chronyd.

1Read the status of a service

Run this:

systemctl status chronyd --no-pager

You should see something like this:

● chronyd.service - NTP client/server
     Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-10-27 09:01:12 IST; 2h 14min ago
 Invocation: 8b3f6c1e2d9a4f7b9c0e5a1d2f3b4c6e
       Docs: man:chronyd(8)
             man:chrony.conf(5)
    Process: 742 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exited, status=0/SUCCESS)
   Main PID: 760 (chronyd)
      Tasks: 1 (limit: 10936)
     Memory: 3.9M (peak: 4.4M)
        CPU: 98ms
     CGroup: /system.slice/chronyd.service
             └─760 /usr/sbin/chronyd -F 2

Oct 27 09:01:12 rocky01 systemd[1]: Starting chronyd.service - NTP client/server...
Oct 27 09:01:12 rocky01 systemd[1]: Started chronyd.service - NTP client/server.

The green dot means active. Loaded says the unit file is in /usr/lib (the package put it there), it is enabled for boot, and the vendor preset agrees. Active says it has been running since boot. chronyd is Type=forking, so the Process line shows the starter that exited with 0/SUCCESS and Main PID 760 is the daemon that stayed.

The last lines come from the journal, which is why you need sudo or the wheel group to see all of them.

Without --no-pager systemctl opens long output in less; press q to quit. A reader using a narrow window may see lines cut on the right: add -l to see them in full.

✅ Checkpoint: You can point to the line that says it starts at boot and the line that says it runs now.

2Ask yes-or-no questions the script way

Run this:

systemctl is-active chronyd
systemctl is-enabled chronyd
systemctl is-failed chronyd; echo "exit code: $?"

You should see this:

active
enabled
active
exit code: 1

Each prints one word and sets an exit code: 0 for “yes”, non-zero for “no”. is-failed answers “is it in the failed state?”, so for a healthy service it prints the real state (active) and exits with 1, meaning no. In a script you write if systemctl is-active --quiet chronyd; then ... and the word isn’t printed at all.

✅ Checkpoint: is-active and is-enabled both say yes, and is-failed returns exit code 1.

3Stop, start, restart and try a reload

Run this:

sudo systemctl stop chronyd
systemctl is-active chronyd
sudo systemctl start chronyd
systemctl show -p MainPID chronyd
sudo systemctl restart chronyd
systemctl show -p MainPID chronyd
sudo systemctl reload chronyd

You should see something like this:

inactive
MainPID=2187
MainPID=2203
Failed to reload chronyd.service: Job type reload is not applicable for unit chronyd.service.

stop and start print nothing when they work, so check with is-active. Each start gives a new main PID. The reload fails because chronyd’s unit has no ExecReload= line; Nginx and sshd have one, which is why you reload them after a config change instead of restarting. systemctl reload-or-restart chronyd does whichever the unit supports.

Try it yourself: build the restart-and-check commands for any service in the Command Builder.

✅ Checkpoint: The PID changed after restart, and you can say why the reload was refused.

4Disable and enable for boot

Run this:

sudo systemctl disable chronyd
systemctl is-enabled chronyd; systemctl is-active chronyd
sudo systemctl enable --now chronyd
ls -l /etc/systemd/system/multi-user.target.wants/chronyd.service

You should see something like this:

Removed '/etc/systemd/system/multi-user.target.wants/chronyd.service'.
disabled
active
Created symlink '/etc/systemd/system/multi-user.target.wants/chronyd.service' → '/usr/lib/systemd/system/chronyd.service'.
lrwxrwxrwx. 1 root root 39 Oct 27 11:21 /etc/systemd/system/multi-user.target.wants/chronyd.service -> /usr/lib/systemd/system/chronyd.service

disable only removed the boot symlink: chronyd was still active afterwards. enable put the symlink back, and --now also started it (it was already running, so nothing changed there). That symlink is all “enabled” means. The dot after the permissions in ls is the SELinux label marker you met in Lesson 17.

Try it yourself: build enable, start and status for any service in the Command Builder.

✅ Checkpoint: is-enabled says disabled after the first command and enabled after the enable.

5Find the unit file and see it the way systemd does

Run this:

systemctl show -p FragmentPath chronyd
systemctl list-unit-files 'chrony*'
systemctl cat chronyd | head -n 13

You should see something like this:

FragmentPath=/usr/lib/systemd/system/chronyd.service
UNIT FILE                  STATE    PRESET
chrony-wait.service        disabled disabled
chronyd-restricted.service disabled disabled
chronyd.service            enabled  enabled

3 unit files listed.
# /usr/lib/systemd/system/chronyd.service
[Unit]
Description=NTP client/server
Documentation=man:chronyd(8) man:chrony.conf(5)
After=ntpdate.service sntp.service ntpd.service
Conflicts=ntpd.service systemd-timesyncd.service
ConditionCapability=CAP_SYS_TIME

[Service]
Type=forking
PIDFile=/run/chrony/chronyd.pid
EnvironmentFile=-/etc/sysconfig/chronyd
ExecStart=/usr/sbin/chronyd $OPTIONS

list-unit-files shows what exists on disk and its boot state, including the two helper units chrony ships. systemctl cat prints the unit file with a comment line naming the path, and later prints every drop-in under it, so it’s the quickest way to see the settings systemd uses. Type=forking, the EnvironmentFile and the $OPTIONS variable tell you where chronyd gets its command-line options.

✅ Checkpoint: You know chronyd’s unit file is in /usr/lib/systemd/system and that you must not edit it there.

6Change a setting with a drop-in

Run this (it opens your editor, nano or vi):

sudo systemctl edit chronyd

Type these three lines in the empty space between the two comment lines at the top, then save and quit:

[Service]
Restart=on-failure
RestartSec=5s

Then check what systemd now uses:

systemctl cat chronyd | tail -n 4
systemctl show -p Restart chronyd
systemctl show -p RestartUSec chronyd

You should see this:

# /etc/systemd/system/chronyd.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5s
Restart=on-failure
RestartUSec=5s

systemctl edit created the folder and override.conf for you and ran daemon-reload by itself when you saved. The vendor file is untouched. Now prove the setting works: kill chronyd hard and watch systemd bring it back.

sudo kill -9 $(systemctl show -p MainPID --value chronyd)
sleep 7
sudo journalctl -u chronyd -n 5 --no-pager

You should see something like this:

Oct 27 11:27:40 rocky01 systemd[1]: chronyd.service: Main process exited, code=killed, status=9/KILL
Oct 27 11:27:40 rocky01 systemd[1]: chronyd.service: Failed with result 'signal'.
Oct 27 11:27:45 rocky01 systemd[1]: chronyd.service: Scheduled restart job, restart counter is at 1.
Oct 27 11:27:45 rocky01 systemd[1]: Starting chronyd.service - NTP client/server...
Oct 27 11:27:45 rocky01 systemd[1]: Started chronyd.service - NTP client/server.

SIGKILL counts as a failure, so on-failure restarted it after the 5 seconds you set. Plain systemctl stop never triggers a restart, because that’s you asking for it.

In a script, or when you can’t open an editor, pipe the content in instead: printf '[Service]\nRestart=on-failure\nRestartSec=5s\n' | sudo systemctl edit --stdin chronyd. The --stdin option needs systemd 256 or newer, which Rocky 10 and Ubuntu 26.04 both have.

✅ Checkpoint: The journal shows “Scheduled restart job” and chronyd is active again with a new PID.

7Mask a service so nothing can start it

Run this:

sudo systemctl stop chronyd
sudo systemctl mask chronyd
sudo systemctl start chronyd
systemctl is-enabled chronyd

You should see this:

Created symlink '/etc/systemd/system/chronyd.service' → '/dev/null'.
Failed to start chronyd.service: Unit chronyd.service is masked.
masked

mask puts a link to /dev/null in /etc/systemd/system, the folder that wins, so systemd sees an empty unit and refuses every start, whether it comes from you, a dependency or a reboot. disable only stops the automatic start at boot; another unit can still pull a disabled service in. Use mask when two services fight over the same job, for example chronyd and another time daemon, or a service that must stay down during an investigation.

Undo it:

sudo systemctl unmask chronyd
sudo systemctl start chronyd
systemctl is-active chronyd; systemctl is-enabled chronyd

Removed '/etc/systemd/system/chronyd.service'.
active
enabled

Try it yourself: build the mask and unmask commands in the Command Builder.

✅ Checkpoint: Start was refused while masked, and after unmask chronyd is active and still enabled.

8Look at the targets

Run this:

systemctl get-default
systemctl list-units --type=target --state=active --no-legend | head -n 6
systemctl list-dependencies multi-user.target | grep -E 'chronyd|crond|sshd'

You should see something like this:

multi-user.target
  basic.target               loaded active active Basic System
  cryptsetup.target          loaded active active Local Encrypted Volumes
  getty.target               loaded active active Login Prompts
  local-fs-pre.target        loaded active active Preparation for Local File Systems
  local-fs.target            loaded active active Local File Systems
  multi-user.target          loaded active active Multi-User System
● ├─chronyd.service
● ├─crond.service
● ├─sshd.service

rocky01 boots to multi-user.target, the normal server target with networking and logins but no desktop. chronyd, crond and sshd are in its list because they were enabled with WantedBy=multi-user.target. On Ubuntu Server get-default often prints graphical.target, because that’s the link the systemd package ships; with no desktop installed it behaves like multi-user.target.

✅ Checkpoint: get-default says multi-user.target and chronyd appears in its dependency list.