Mastering systemd: Timers, Targets, and the Tricks Nobody Tells You

Beyond systemctl start

Everyone knows systemctl start nginx. But systemd is a full init system, service manager, timer scheduler, and logging framework. Understanding it deeply transforms how you manage Linux servers.

Timers: Cron's Successor

Systemd timers are strictly better than cron. They provide:

• Randomized delay windows (prevent thundering herd)
• Persistent missed executions (catch up after downtime)
• Calendar events with timezone support
• Monotonic timers (relative to boot, not wall clock)
• Built-in logging via journald

Example: Daily Backup Timer

# /etc/systemd/system/backup.service
[Unit]
Description=Daily backup
[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh

# /etc/systemd/system/backup.timer
[Unit]
Description=Daily backup timer
[Timer]
OnCalendar=daily
RandomizedDelaySec=1800
Persistent=true
[Install]
WantedBy=timers.target

systemctl enable backup.timer --now and you're done. The backup runs daily at a random time within a 30-minute window, catches up if the server was down, and logs everything to journald.

Targets: Boot Ordering Done Right

Targets are systemd's replacement for runlevels — but far more flexible. They let you declare what should be available rather than what runlevel to enter.

• multi-user.target: Normal server operation (equivalent to runlevel 3)
• graphical.target: GUI available (runlevel 5)
• network-online.target: Network is fully up — critical for services that need DNS

The key insight: use After= and Wants= to declare dependencies, not ExecStartPre=sleep 10. Your services should wait for network-online.target, not guess when the network is ready.

Journald: Logs That Actually Help

Stop grepping through /var/log/syslog. Journald provides:

# See all logs for a service since last boot
journalctl -u nginx -b

# Follow logs in real time
journalctl -u nginx -f

# See logs from the previous boot (crashed? check this)
journalctl -u nginx -b -1

# Filter by priority
journalctl -p err -b

# Time-based queries
journalctl --since "2026-08-01" --until "2026-08-03"

Sandboxing Services

Systemd can sandbox services without Docker. Add these to any service unit:

[Service]
PrivateTmp=true           # Isolated /tmp
ProtectSystem=strict      # Read-only filesystem except /var
ProtectHome=true          # No access to /home
NoNewPrivileges=true      # No privilege escalation
ReadOnlyPaths=/etc/myapp  # Only this path is writable

Troubleshooting: The Hidden Commands

• systemd-analyze blame: See what's slowing down boot
• systemd-analyze critical-chain: Find the critical path in your boot sequence
• systemctl list-dependencies nginx.service: See what nginx depends on
• systemctl cat nginx: View the full unit file, including overrides
• systemctl show nginx: Every property of the service, machine-readable

Master these, and you'll spend less time debugging and more time building.