Write your own systemd service and timer

You’ll create three files on rocky01: /usr/local/bin/disk-report.sh, /etc/systemd/system/disk-report.service and /etc/systemd/system/disk-report.timer. Lessons 28, 39 and 68 come back to them, so keep the names and paths as they are. The times in the outputs are from one run on 27 October; yours will show your own date and time.

1Write the script and run it by hand

Paste this whole block:

sudo tee /usr/local/bin/disk-report.sh > /dev/null <<'EOF'
#!/bin/bash
# disk-report.sh: show how full the local file systems are and warn above a limit.
# SaatVedha Linux Administration, Lesson 27. Runs from disk-report.service.
LIMIT=80
SKIP=(-x tmpfs -x devtmpfs -x efivarfs -x squashfs -x overlay)

echo "Disk report for $(hostname -s) at $(date '+%F %T')"
df -h --output=target,fstype,size,used,avail,pcent "${SKIP[@]}"

warn=0
while read -r mnt pct; do
    pct=${pct%\%}
    if [ "$pct" -ge "$LIMIT" ]; then
        echo "WARNING: $mnt is ${pct}% full (limit ${LIMIT}%)"
        warn=1
    fi
done < <(df --output=target,pcent "${SKIP[@]}" | tail -n +2)

if [ "$warn" -eq 0 ]; then
    echo "OK: every file system is below ${LIMIT}%"
fi
EOF
sudo chmod 755 /usr/local/bin/disk-report.sh
/usr/local/bin/disk-report.sh

You should see something like this:

Disk report for rocky01 at 2026-10-27 11:40:18
Mounted on Type  Size  Used Avail Use%
/          xfs    17G  1.9G   15G  12%
/boot      xfs   960M  297M  664M  31%
/boot/efi  vfat  599M  8.4M  591M   2%
OK: every file system is below 80%

-x leaves out memory-backed file systems such as tmpfs, so only real disks are listed. The while loop reads each mount point and its Use% from a second df, strips the % sign and prints a WARNING line for anything at 80 percent or more. The script needs no root rights to read df, but it will run as root from systemd, which is why it lives in a folder only root can write to.

Your sizes depend on your disk. If any line is above 80 percent you’ll see a WARNING line instead of the OK line, which is the script doing its job.

✅ Checkpoint: The script prints the header, your three file systems and the OK line.

2Check the owner, mode and SELinux label

Run this:

ls -lZ /usr/local/bin/disk-report.sh

You should see something like this:

-rwxr-xr-x. 1 root root unconfined_u:object_r:bin_t:s0 684 Oct 27 11:40 /usr/local/bin/disk-report.sh

Owner root, mode 755 (everyone can run it, only root can change it) and the SELinux type bin_t. The file got bin_t because tee created it inside /usr/local/bin, and new files take the label of their folder. Keep this line in mind for the Break-It section.

✅ Checkpoint: Your file is owned by root, has x bits and shows bin_t.

3Write the service file and verify it

Paste this whole block:

sudo tee /etc/systemd/system/disk-report.service > /dev/null <<'EOF'
[Unit]
Description=Disk usage report for local file systems
Documentation=https://saatvedha.com/lesson/systemd-service-file/

[Service]
Type=oneshot
ExecStart=/usr/local/bin/disk-report.sh
EOF
sudo systemd-analyze verify /etc/systemd/system/disk-report.service && echo 'verify: no problems'

You should see this:

verify: no problems

Type=oneshot because the script runs and exits. There’s no User= line, so it runs as root, which is fine for a read-only report; for an application you’d add User=appsvc. There’s no [Install] section either, because the timer starts this service. verify printed nothing, which means it found no problem, and the && line only ran because its exit code was 0.

Try it yourself: build a service file, simple or oneshot, in the Command Builder.

✅ Checkpoint: verify reports no problems.

4Start the service once and read the result

Run this:

sudo systemctl daemon-reload
sudo systemctl start disk-report.service
systemctl status disk-report.service --no-pager | head -n 7
journalctl -u disk-report.service --no-pager

You should see something like this:

○ disk-report.service - Disk usage report for local file systems
     Loaded: loaded (/etc/systemd/system/disk-report.service; static)
     Active: inactive (dead) since Tue 2026-10-27 11:43:05 IST; 9s ago
 Invocation: 3c0e0b8f6a0d4a63b5d1f0e2c7a91d54
       Docs: https://saatvedha.com/lesson/systemd-service-file/
    Process: 2398 ExecStart=/usr/local/bin/disk-report.sh (code=exited, status=0/SUCCESS)
   Main PID: 2398 (code=exited, status=0/SUCCESS)
Oct 27 11:43:05 rocky01 systemd[1]: Starting disk-report.service - Disk usage report for local file systems...
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: Disk report for rocky01 at 2026-10-27 11:43:05
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: Mounted on Type  Size  Used Avail Use%
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: /          xfs    17G  1.9G   15G  12%
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: /boot      xfs   960M  297M  664M  31%
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: /boot/efi  vfat  599M  8.4M  591M   2%
Oct 27 11:43:05 rocky01 disk-report.sh[2398]: OK: every file system is below 80%
Oct 27 11:43:05 rocky01 systemd[1]: disk-report.service: Deactivated successfully.
Oct 27 11:43:05 rocky01 systemd[1]: Finished disk-report.service - Disk usage report for local file systems.

For a oneshot service, inactive (dead) with status=0/SUCCESS is the good result: it ran and finished. systemctl start waited until the script ended, and the journal shows the whole story with the script’s output in between “Starting” and “Finished”. journalctl works without sudo here because student is in wheel, which can read the system journal on Rocky; on Ubuntu the group is adm.

✅ Checkpoint: Status shows static and status=0/SUCCESS, and the journal holds the report lines.

5Write the timer and check the schedule

Paste this whole block:

sudo tee /etc/systemd/system/disk-report.timer > /dev/null <<'EOF'
[Unit]
Description=Run disk-report every day at 02:30

[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true

[Install]
WantedBy=timers.target
EOF
systemd-analyze calendar '*-*-* 02:30:00'
sudo systemd-analyze verify /etc/systemd/system/disk-report.timer && echo 'verify: no problems'

You should see something like this:

Normalized form: *-*-* 02:30:00
    Next elapse: Wed 2026-10-28 02:30:00 IST
       (in UTC): Tue 2026-10-27 21:00:00 UTC
       From now: 14h left
verify: no problems

The calendar check shows the next run in IST and in UTC, so you can see that rocky01 uses the time zone you set in Lesson 2. Add --iterations=3 to see the next three runs. The timer’s [Install] section says WantedBy=timers.target, which is the target that gathers all timers at boot.

✅ Checkpoint: Next elapse is tomorrow at 02:30 in your local time and verify is clean.

6Enable the timer and see it waiting

Run this:

sudo systemctl daemon-reload
sudo systemctl enable --now disk-report.timer
systemctl list-timers disk-report.timer
systemctl status disk-report.timer --no-pager | head -n 6

You should see something like this:

Created symlink '/etc/systemd/system/timers.target.wants/disk-report.timer' → '/etc/systemd/system/disk-report.timer'.
NEXT                        LEFT LAST PASSED UNIT              ACTIVATES
Wed 2026-10-28 02:30:00 IST  14h -         - disk-report.timer disk-report.service

1 timers listed.
Pass --all to see loaded but inactive timers, too.
● disk-report.timer - Run disk-report every day at 02:30
     Loaded: loaded (/etc/systemd/system/disk-report.timer; enabled; preset: disabled)
     Active: active (waiting) since Tue 2026-10-27 11:46:10 IST; 4s ago
 Invocation: 9e41d07c2b3a4c5f8d6e1a2b3c4d5e6f
    Trigger: Wed 2026-10-28 02:30:00 IST; 14h left
   Triggers: ● disk-report.service

You enable the timer, never the service. LAST and PASSED show a dash because the timer hasn’t fired yet; starting the service by hand in step 4 doesn’t count. “preset: disabled” is normal for your own units on Rocky, whose default preset is to leave new units disabled until you decide.

Try it yourself: build a service and timer pair for any script in the Command Builder.

✅ Checkpoint: list-timers shows disk-report.timer with NEXT at 02:30 and status says active (waiting).

7Watch the timer fire with a short test schedule

Add a temporary drop-in that runs it every two minutes:

printf '[Timer]\nOnCalendar=\nOnCalendar=*:0/2\n' | sudo systemctl edit --stdin disk-report.timer
sudo systemctl restart disk-report.timer
systemctl list-timers disk-report.timer --no-legend

You should see something like this:

Tue 2026-10-27 11:50:00 IST 1min 32s -         - disk-report.timer disk-report.service

The empty OnCalendar= clears the 02:30 schedule, the same list rule you met with ExecStart= in Lesson 26. Wait about three minutes, then read the journal:

journalctl -u disk-report.service --since '11:49' --no-pager | grep -E 'Starting|OK|Finished'

You should see something like this:

Oct 27 11:50:37 rocky01 systemd[1]: Starting disk-report.service - Disk usage report for local file systems...
Oct 27 11:50:37 rocky01 disk-report.sh[2442]: OK: every file system is below 80%
Oct 27 11:50:37 rocky01 systemd[1]: Finished disk-report.service - Disk usage report for local file systems.

It ran at 11:50:37, not 11:50:00, because of AccuracySec= (one minute by default). If you need a job on the exact second, add AccuracySec=1s to the timer. Now remove the test drop-in and go back to the nightly schedule:

sudo rm -r /etc/systemd/system/disk-report.timer.d
sudo systemctl daemon-reload
sudo systemctl restart disk-report.timer
systemctl list-timers disk-report.timer --no-legend

Wed 2026-10-28 02:30:00 IST  14h Tue 2026-10-27 11:50:37 IST 3min 2s ago disk-report.timer disk-report.service

✅ Checkpoint: The journal shows a run started by the timer, and NEXT is back at 02:30 with LAST filled in.

8See what Persistent=true stores

Run this:

sudo ls -l /var/lib/systemd/timers/
systemctl show -p LastTriggerUSec disk-report.timer
systemctl list-unit-files 'disk-report*'

You should see something like this:

total 0
-rw-r--r--. 1 root root 0 Oct 27 11:50 stamp-disk-report.timer
-rw-r--r--. 1 root root 0 Oct 27 09:12 stamp-logrotate.timer
LastTriggerUSec=Tue 2026-10-27 11:50:37 IST
UNIT FILE           STATE   PRESET
disk-report.service static  -
disk-report.timer   enabled disabled

2 unit files listed.

The stamp file is empty; only its modification time matters. If rocky01 is switched off at 02:30 tonight, systemd sees at the next boot that the last run is older than the last scheduled time and starts disk-report.service once. logrotate.timer has a stamp too, because the logrotate package also uses Persistent=true.

✅ Checkpoint: stamp-disk-report.timer exists, and list-unit-files shows the service static and the timer enabled.