SYSTEMD-ANALYZE(1) systemd-analyze SYSTEMD-ANALYZE(1) systemd-analyze - systemd-analyze [OPTIONS...] [time] systemd-analyze [OPTIONS...] blame systemd-analyze [OPTIONS...] critical-chain [UNIT...] systemd-analyze [OPTIONS...] dump [PATTERN...] systemd-analyze [OPTIONS...] plot [>file.svg] systemd-analyze [OPTIONS...] dot [PATTERN...] [>file.dot] systemd-analyze [OPTIONS...] unit-files systemd-analyze [OPTIONS...] unit-gdb SERVICE systemd-analyze [OPTIONS...] unit-paths systemd-analyze [OPTIONS...] unit-shell SERVICE [Command...] systemd-analyze [OPTIONS...] exit-status [STATUS...] systemd-analyze [OPTIONS...] capability [CAPABILITY... | {-m | --mask} MASK] systemd-analyze [OPTIONS...] condition CONDITION... systemd-analyze [OPTIONS...] syscall-filter [SET...] systemd-analyze [OPTIONS...] filesystems [SET...] systemd-analyze [OPTIONS...] calendar SPEC... systemd-analyze [OPTIONS...] timestamp TIMESTAMP... systemd-analyze [OPTIONS...] timespan SPAN... systemd-analyze [OPTIONS...] cat-config NAME|PATH... systemd-analyze [OPTIONS...] compare-versions VERSION1 [OP] VERSION2 systemd-analyze [OPTIONS...] verify FILE... systemd-analyze [OPTIONS...] security [UNIT...] systemd-analyze [OPTIONS...] inspect-elf FILE... systemd-analyze [OPTIONS...] malloc [D-BUS SERVICE...] systemd-analyze [OPTIONS...] fdstore UNIT... systemd-analyze [OPTIONS...] image-policy POLICY... systemd-analyze [OPTIONS...] has-tpm2 systemd-analyze [OPTIONS...] identify-tpm2 systemd-analyze [OPTIONS...] pcrs [PCR...] systemd-analyze [OPTIONS...] nvpcrs [NVPCR...] systemd-analyze [OPTIONS...] srk [>FILE] systemd-analyze [OPTIONS...] architectures [NAME...] systemd-analyze [OPTIONS...] smbios11 systemd-analyze [OPTIONS...] chid systemd-analyze [OPTIONS...] transient-settings TYPE... systemd-analyze . . systemd-analyze time. systemd-analyze time initrd . . 1. # $ systemd-analyze time Startup finished in 296ms (userspace) multi-user.target reached after 275ms in userspace # $ systemd-analyze time Startup finished in 2.584s (kernel) + 19.176s (initrd) + 47.847s (userspace) = 1min 9.608s multi-user.target reached after 47.820s in userspace systemd-analyze blame . . . : systemd-analyze blame Type=simple systemd . . "" (activating) " " (inactive) "" (active). . 2. $ systemd-analyze blame 32.875s pmlogger.service 20.905s systemd-networkd-wait-online.service 13.299s dev-vda1.device ... 23ms sysroot.mount 11ms initrd-udevadm-cleanup-db.service 3ms sys-kernel-config.mount systemd-analyze critical-chain [UNIT...] ( UNITs ). "@". "+". . blame "" "" ( " " ""). ( ). 3. systemd-analyze critical-chain $ systemd-analyze critical-chain multi-user.target @47.820s pmie.service @35.968s +548ms pmcd.service @33.715s +2.247s network-online.target @33.712s systemd-networkd-wait-online.service @12.804s +20.905s systemd-networkd.service @11.109s +1.690s systemd-udevd.service @9.201s +1.904s systemd-tmpfiles-setup-dev.service @7.306s +1.776s kmod-static-nodes.service @6.976s +177ms systemd-journald.socket system.slice -.slice systemd-analyze dump [pattern...] ( ) . glob . . . 4. $ systemd-analyze --user dump Timestamp userspace: Thu 2019-03-14 23:28:07 CET Timestamp finish: Thu 2019-03-14 23:28:07 CET Timestamp generators-start: Thu 2019-03-14 23:28:07 CET Timestamp generators-finish: Thu 2019-03-14 23:28:07 CET Timestamp units-load-start: Thu 2019-03-14 23:28:07 CET Timestamp units-load-finish: Thu 2019-03-14 23:28:07 CET -> Unit proc-timer_list.mount: Description: /proc/timer_list ... -> Unit default.target: Description: Main user target ... systemd-analyze malloc [D-Bus service...] ( malloc_info(3)) D-Bus. org.freedesktop.systemd1 ( ). . org.freedesktop.MemoryAllocation1. systemd . systemd-analyze plot SVG JSON . 5. $ systemd-analyze plot >bootup.svg $ eog bootup.svg& . . . ( ). . systemd-analyze dot [pattern...] dot GraphViz dot(1). systemd-analyze dot | dot -Tsvg >systemd.svg . --order --require . ( *.target) . . 6. "avahi-daemon" $ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg >avahi.svg $ eog avahi.svg 7. $ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' \ | dot -Tsvg >targets.svg $ eog targets.svg systemd-analyze unit-paths .d .wants .requires. --user --global . 8. $ systemd-analyze unit-paths | grep '^/run' /run/systemd/system.control /run/systemd/transient /run/systemd/generator.early /run/systemd/system /run/systemd/system.attached /run/systemd/generator /run/systemd/generator.late systemd-analyze . systemctl [--user] [--global] show -p UnitPath --value . systemd-analyze exit-status [STATUS...] "" ( "libc" "systemd" "LSB" "BSD") systemd.exec(5). . . 9. $ systemd-analyze exit-status 0 1 {63..65} SUCCESS 0 libc FAILURE 1 libc - 63 - USAGE 64 BSD DATAERR 65 BSD systemd-analyze capability [CAPABILITY... | {-m | --mask} MASK] (Linux capabilities) . capabilities(7) . . "cap_???". . --mask . . ( "/proc/PID/status"). 10. $ systemd-analyze capability 0 1 {30..32} cap_chown 0 cap_dac_override 1 cap_audit_control 30 cap_setfcap 31 cap_mac_override 32 11. /proc $ systemd-analyze capability -m 0000000000003c00 cap_net_bind_service 10 cap_net_broadcast 11 cap_net_admin 12 cap_net_raw 13 systemd-analyze condition CONDITION... Condition*=... Assert*=... . systemd.unit(5) (asserts) . 12. $ systemd-analyze condition 'ConditionVersion = ! <4.0' \ 'ConditionVersion = >=5.1' \ 'ConditionACPower=|false' \ 'ConditionArchitecture=|!arm' \ 'AssertPathExists=/etc/os-release' test.service: AssertPathExists=/etc/os-release . . test.service: ConditionArchitecture=|!arm . test.service: ConditionACPower=|false . test.service: ConditionVersion=>=5.1 . test.service: ConditionVersion=!<4.0 . . systemd-analyze syscall-filter [SET...] SET . SET "@". systemd-analyze filesystems [SET...] SET . SET "@". systemd-analyze calendar EXPRESSION... . OnCalendar= systemd.timer(5) systemd.time(7). --iterations= . timestamp . 13. $ systemd-analyze calendar --iterations=5 '*-2-29 0:0:0' : *-2-29 0:0:0 : *-02-29 00:00:00 : Sat 2020-02-29 00:00:00 UTC : 11 15 . #2: Thu 2024-02-29 00:00:00 UTC : 4 11 . #3: Tue 2028-02-29 00:00:00 UTC : 8 11 . #4: Sun 2032-02-29 00:00:00 UTC : 12 11 . #5: Fri 2036-02-29 00:00:00 UTC : 16 11 systemd-analyze timestamp TIMESTAMP... ( ) . systemd.time(7) "PARSING TIMESTAMPS". 14. $ systemd-analyze timestamp yesterday now tomorrow : yesterday : Mon 2019-05-20 00:00:00 CEST ( UTC): Sun 2019-05-19 22:00:00 UTC : @15583032000 : 9 : now : Tue 2019-05-21 09:48:39 CEST ( UTC): Tue 2019-05-21 07:48:39 UTC : @1558424919.659757 : 43 : tomorrow : Wed 2019-05-22 00:00:00 CEST ( UTC): Tue 2019-05-21 22:00:00 UTC : @15584760000 : 14 systemd-analyze timespan EXPRESSION... ( ) . systemd.time(7) "PARSING TIME SPANS". . 15. $ systemd-analyze timespan 1s 300s '1year 0.000001s' : 1s : 1000000 : 1s : 300s : 300000000 : 5min : 1year 0.000001s : 31557600000001 : 1y 1us systemd-analyze cat-config NAME|PATH... systemctl cat . (drop-ins) systemd. ( /etc/systemd/logind.conf /usr/lib/systemd/logind.conf) ( systemd/logind.conf). 16. logind $ systemd-analyze cat-config systemd/logind.conf # /etc/systemd/logind.conf ... [Login] NAutoVTs=8 ... # /usr/lib/systemd/logind.conf.d/20-test.conf ... # /etc/systemd/logind.conf.d/50-override.conf ... systemd-analyze compare-versions VERSION1 [OP] VERSION2 OP . -- OP -- "VERSION1 < VERSION2" "VERSION1 == VERSION2" "VERSION1 > VERSION2" . 0 11 12 . ( rpmdev-vercmp.) -- OP -- OP 0 () 1 () . OP lt le eq ne ge gt. . ( dpkg(1) --compare-versions.) 17. $ systemd-analyze compare-versions systemd-250~rc1.fc36.aarch64 systemd-251.fc36.aarch64 systemd-250~rc1.fc36.aarch64 < systemd-251.fc36.aarch64 $ echo $? 12 $ systemd-analyze compare-versions 1 lt 2; echo $? 0 $ systemd-analyze compare-versions 1 ge 2; echo $? 1 systemd-analyze verify FILE... . . . . $SYSTEMD_UNIT_PATH systemd.unit(5). . ( foo@.service) "test_instance" --instance=. : o o o Documentation= o ExecStart= . 18. $ cat ./user.slice [Unit] WhatIsThis=11 Documentation=man:nosuchfile(1) Requires=different.service [Service] Description=x $ systemd-analyze verify ./user.slice [./user.slice:9] (lvalue) 'WhatIsThis' 'Unit' [./user.slice:13] 'Service'. . : org.freedesktop.systemd1.LoadFailed: different.service: . user.slice/start: user.slice: man nosuchfile(1) 16 19. $ tail ./a.socket ./b.socket ==> ./a.socket <== [Socket] ListenStream=100 ==> ./b.socket <== [Socket] ListenStream=100 Accept=yes $ systemd-analyze verify ./a.socket ./b.socket a.service a.socket. b@0.service b.socket. 20. $ cat /tmp/source [Unit] Description=Hostname printer [Service] Type=simple ExecStart=/usr/bin/echo %H MysteryKey=true $ systemd-analyze verify /tmp/source /tmp/source: $ systemd-analyze verify /tmp/source:alias.service alias.service:7: 'MysteryKey' 'Service' . systemd-analyze security [UNIT...] (sandboxing) . . . " " . 0.0 10.0 . . . systemd . . : . . -- . . . . . (IPC) ( D-Bus) . IPC . 21. systemd-logind.service $ systemd-analyze security --no-pager systemd-logind.service PrivateNetwork= 0.5 User=/DynamicUser= (root) 0.4 DeviceAllow= (ACL) 0.2 \/ IPAddressDeny= IP ... -> systemd-logind.service: 4.1 systemd-analyze inspect-elf FILE... ELF ( (core files) .) json. Package Metadata for Executable Files[1] . 22. (core file) JSON $ systemd-analyze inspect-elf --json=pretty \ core.fsverity.1000.f77dac5dc161402aa44e15b7dd9dcf97.58561.1637106137000000 { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64", "/home/bluca/git/fsverity-utils/fsverity" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" }, "/home/bluca/git/fsverity-utils/libfsverity.so.0" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "b5e428254abf14237b0ae70ed85fffbb98a78f88" } } systemd-analyze dlopen-metadata FILE ELF ( .) dlopen json. dlopen() Metadata for ELF Files[2] . systemd-analyze fdstore UNIT... . (inodes) . FileDescriptorStoreMax= systemd.service(5) . 23. $ systemd-analyze fdstore systemd-journald.service FDNAME TYPE DEVNO INODE RDEVNO PATH FLAGS stored sock 0:8 4218620 - socket:[4218620] ro stored sock 0:8 4213198 - socket:[4213198] ro stored sock 0:8 4213190 - socket:[4213190] ro ... : "DEVNO" / (major/minor) (inode) . "RDEVNO" / . .st_dev .st_rdev struct stat ( stat(2) ). "INODE" "DEVNO". systemd-analyze image-policy POLICY... systemd.image-policy(7). . ( UAPI.2 Discoverable Partitions Specification[3]) . 24. $ systemd-analyze image-policy swap=encrypted:usr=read-only-on+verity:root=encrypted : root=encrypted:usr=verity+read-only-on:swap=encrypted : root=encrypted:usr=verity+read-only-on:swap=encrypted:=unused+absent PARTITION MODE READ-ONLY GROWFS root encrypted - - usr verity yes - home ignore - - srv ignore - - esp ignore - - xbootldr ignore - - swap encrypted - - root-verity ignore - - usr-verity unprotected yes - root-verity-sig ignore - - usr-verity-sig ignore - - tmp ignore - - var ignore - - default ignore - - systemd-analyze has-tpm2 TPM2 . TPM2 (firmware) ( systemd) "yes" . // "no". "partial". . // TPM2. libtss2-esys.so.0 libtss2-rc.so.0 libtss2-mu.so.0. . TPM 2.0 TPM 1.2 . --quiet . 25. yes +firmware +driver +system +subsystem +libraries +libtss2-esys.so.0 +libtss2-rc.so.0 +libtss2-mu.so.0 257. systemd-analyze identify-tpm2 TPM 2.0 . 26. Family Indicator: 2.0 Level: 0 Revision: 1.59 Specification Date: Mon 2023-01-09 Manufacturer: STM Vendor String: ST33KTPM2XSPI Firmware Version: 9.258 Modalias String: fi2.0:lv0:rv1.59:sy2023:sd9:mfSTM:vsST33KTPM2XSPI:ty0:fw9.258.0: 260. systemd-analyze pcrs [PCR...] PCR TPM2 . 27. $ systemd-analyze pcrs NR NAME SHA256 0 platform-code bcd2eb527108bbb1f5528409bcbe310aa9b74f687854cc5857605993f3d9eb11 1 platform-config b60622856eb7ce52637b80f30a520e6e87c347daa679f3335f4f1a600681bb01 2 external-code 1471262403e9a62f9c392941300b4807fbdb6f0bfdd50abfab752732087017dd 3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 4 boot-loader-code 939f7fa1458e1f7ce968874d908e524fc0debf890383d355e4ce347b7b78a95c 5 boot-loader-config 864c61c5ea5ecbdb6951e6cb6d9c1f4b4eac79772f7fe13b8bece569d83d3768 6 - 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 7 secure-boot-policy 9c905bd9b9891bfb889b90a54c4b537b889cfa817c4389cc25754823a9443255 8 - 0000000000000000000000000000000000000000000000000000000000000000 9 kernel-initrd 9caa29b128113ef42aa53d421f03437be57211e5ebafc0fa8b5d4514ee37ff0c 10 ima 5ea9e3dab53eb6b483b6ec9e3b2c712bea66bca1b155637841216e0094387400 11 kernel-boot 0000000000000000000000000000000000000000000000000000000000000000 12 kernel-config 627ffa4b405e911902fe1f1a8b0164693b31acab04f805f15bccfe2209c7eace 13 sysexts 0000000000000000000000000000000000000000000000000000000000000000 14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000 15 system-identity 0000000000000000000000000000000000000000000000000000000000000000 16 debug 0000000000000000000000000000000000000000000000000000000000000000 17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 23 application-support 0000000000000000000000000000000000000000000000000000000000000000 systemd-analyze nvpcrs [NVPCR...] NvPCR TPM2 ( PCR TPM2 NV) . 28. $ systemd-analyze nvpcrs NV cryptsetup 0x1d10201 f400543943cc7215557ce672872ace5382e6d53177cc459078ba9277e41588d9 hardware 0x1d10200 e155474936d7d74c893e6ece1099a2311d572cf23becea159dabf282db754284 259. systemd-analyze srk [>FILE] (SRK) TPM2 TPM2B_PUBLIC (marshalled) (stdout). . 29. srk.tpm2b_public systemd-analyze srk >srk.tpm2b_public systemd-analyze architectures [NAME...] (CPU) (native). ConditionArchitecture= systemd.unit(5) . . 30. $ systemd-analyze architectures alpha arc arc-be arm arm64 ... sparc sparc64 tilegx x86 x86-64 systemd-analyze smbios11 SMBIOS #11 . smbios-type-11(7). 31. $ systemd-analyze smbios11 io.systemd.stub.kernel-cmdline-extra=console=ttyS0 io.systemd.credential.binary:ssh.ephemeral-authorized_keys-all=c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSURGd20xbFp4WlRGclJteG9ZQlozOTYzcE1uYlJCaDMwM1MxVXhLSUM2NmYgbGVubmFydEB6ZXRhCg== io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042 3 SMBIOS #11. 257. systemd-analyze chid (CHIDs) . SMBIOS. (CHIDs)[4] CHIDs. 32. $ systemd-analyze chid CHID 3 MFPSmp 520537c0-3b59-504f-b062-9682ea236b21 4 MFPS-- edf05dc8-a53d-5b2c-8023-630bca2a2463 5 MFP--- ebc6a4d9-ec48-537a-916b-c69fa4fdd814 6 M--Smp 5ebe4bba-f598-5e90-9ff2-9fd0d3211465 7 M--S-- 1a3fb835-b42a-5f9c-a38c-eff5bfd5c41d 8 M-P-mp 2a831dce-8163-5bad-8406-435b8c752dd8 9 M-P--- 7c21c878-4a75-50f7-9816-21e811588da0 10 MF--mp 9a003537-bcc5-500e-b10a-8d8892e4fc64 11 MF---- bb9122bb-8a5c-50d2-a742-a85beb719909 13 M---mp bfc36935-5032-5987-a0a3-6311f01de33a : M <- sys_vendor (LENOVO) F <- product_family (ThinkPad X1 Carbon Gen 9) P <- product_name (20XW0055GE) S <- product_sku (LENOVO_MT_20XW_BU_Think_FM_ThinkPad X1 Carbon Gen 9) m <- board_vendor (LENOVO) p <- board_name (20XW0055GE) 258. systemd-analyze transient-settings ... systemctl(1) set-property --property=/--automount-property= systemd-run(1) systemd-nspawn(1) systemd-mount(1). systemd.unit(5) systemd.exec(5) systemd.resource-control(5) . ("service" "socket" ...). . : D-Bus org.freedesktop.systemd1(5) . D-Bus LogRateLimitIntervalSec= systemd.exec(5) D-Bus systemd.exec(5) LogRateLimitIntervalUSec. . 258. systemd-analyze unit-shell [...] . . 33. $ systemd-analyze unit-shell systemd-resolved.service ls bin dev etc home lib lib64 lost+found mnt proc run srv tmp var vmlinuz.old boot efi exitrd init lib32 libx32 media opt root sbin sys usr vmlinuz work 258. systemd-analyze unit-gdb . gdb(1). --debugger= $SYSTEMD_DEBUGGER. --debugger-arguments= ( ). 34. $ systemd-analyze --debugger-arguments="-batch -ex 'info all-registers'" unit-gdb systemd-oomd.service 258. : --system systemd . . 209. --user systemd . 186. --global systemd . 238. --order --require dot ( ) . --order After= Before=. --require Requires= Requisite= BindsTo= Wants= Conflicts=. . 198. --from-pattern= --to-pattern= dot ( ) . glob(7) . . . . . 201. --fuzz=_ critical-chain ( ) _ . _ "50ms". 203. --man=no man(1) Documentation=. 235. --generators systemd.generator(7). . . 235. --instance=NAME . ( foo@.service) systemd-analyze condition --unit= systemd-analyze security systemd-analyze verify. "test_instance". 257. --recursive-errors= systemd-analyze verify . yes . no . one . . 250. --root= cat-config verify condition unit-gdb security --offline= . 239. --image= cat-config verify condition security --offline= . 250. --image-policy= systemd.image-policy(7). --image= . "*" . --offline=_ security PID 1 security . --offline= --root= --image= . --threshold= ( 100) --offline= . 250. --profile= security --offline= . (drop-in) . 250. --threshold= security . security . --threshold= --offline= 100. 250. --security-policy= security JSON () . 1. +---------------------------------------------------------+ | | +---------------------------------------------------------+ |UserOrDynamicUser | +---------------------------------------------------------+ |SupplementaryGroups | +---------------------------------------------------------+ |PrivateMounts | +---------------------------------------------------------+ |PrivateDevices | +---------------------------------------------------------+ |PrivateTmp | +---------------------------------------------------------+ |PrivateNetwork | +---------------------------------------------------------+ |PrivateUsers | +---------------------------------------------------------+ |ProtectControlGroups | +---------------------------------------------------------+ |ProtectKernelModules | +---------------------------------------------------------+ |ProtectKernelTunables | +---------------------------------------------------------+ |ProtectKernelLogs | +---------------------------------------------------------+ |ProtectClock | +---------------------------------------------------------+ |ProtectHome | +---------------------------------------------------------+ |ProtectHostname | +---------------------------------------------------------+ |ProtectSystem | +---------------------------------------------------------+ |RootDirectoryOrRootImage | +---------------------------------------------------------+ |LockPersonality | +---------------------------------------------------------+ |MemoryDenyWriteExecute | +---------------------------------------------------------+ |NoNewPrivileges | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_ADMIN | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SET_UID_GID_PCAP | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_PTRACE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_TIME | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_NET_ADMIN | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_RAWIO | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_MODULE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_AUDIT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYSLOG | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_MKNOD | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_KILL | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_BOOT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_MAC | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_LINUX_IMMUTABLE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_IPC_LOCK | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_CHROOT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_BLOCK_SUSPEND | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_WAKE_ALARM | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_LEASE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_TTY_CONFIG | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_BPF | +---------------------------------------------------------+ | (UMask) | +---------------------------------------------------------+ | | |(KeyringMode) | +---------------------------------------------------------+ |ProtectProc | +---------------------------------------------------------+ |ProcSubset | +---------------------------------------------------------+ |NotifyAccess | +---------------------------------------------------------+ |RemoveIPC | +---------------------------------------------------------+ |Delegate | +---------------------------------------------------------+ |RestrictRealtime | +---------------------------------------------------------+ |RestrictSUIDSGID | +---------------------------------------------------------+ |RestrictNamespaces_user | +---------------------------------------------------------+ |RestrictNamespaces_mnt | +---------------------------------------------------------+ |RestrictNamespaces_ipc | +---------------------------------------------------------+ |RestrictNamespaces_pid | +---------------------------------------------------------+ |RestrictNamespaces_cgroup | +---------------------------------------------------------+ |RestrictNamespaces_uts | +---------------------------------------------------------+ |RestrictNamespaces_net | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_INET_INET6 | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_UNIX | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_NETLINK | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_PACKET | +---------------------------------------------------------+ |RestrictAddressFamilies_OTHER | +---------------------------------------------------------+ | | |(SystemCallArchitectures) | +---------------------------------------------------------+ |SystemCallFilter_swap | +---------------------------------------------------------+ |SystemCallFilter_obsolete | +---------------------------------------------------------+ |SystemCallFilter_clock | +---------------------------------------------------------+ |SystemCallFilter_cpu_emulation | +---------------------------------------------------------+ |SystemCallFilter_debug | +---------------------------------------------------------+ |SystemCallFilter_mount | +---------------------------------------------------------+ |SystemCallFilter_module | +---------------------------------------------------------+ |SystemCallFilter_raw_io | +---------------------------------------------------------+ |SystemCallFilter_reboot | +---------------------------------------------------------+ |SystemCallFilter_privileged | +---------------------------------------------------------+ |SystemCallFilter_resources | +---------------------------------------------------------+ |IPAddressDeny | +---------------------------------------------------------+ |DeviceAllow | +---------------------------------------------------------+ |AmbientCapabilities | +---------------------------------------------------------+ " JSON" . 250. --json=MODE security JSON . JSON : set name json_field JSON description exposure 0.0...10.0 . JSON . : off pretty short JSON . plot JSON . JSON : name activated activating time deactivated deactivating . 250. --iterations= calendar . 1. 242. --base-time=_ calendar . . 244. --unit= condition Condition*=... Assert*=... . . $SYSTEMD_UNIT_PATH systemd.unit(5). . ( foo@.service) "test_instance" --instance=. 250. --table plot . 253. --no-legend plot --table --json= . 253. -H --host= . "@" . ssh ":" "/" . SSH . machinectl -H . IPv6 . -M --machine= . "@" . ".host" ( : "--user --machine=lennart@.host"). "@" (root). "@" ( ) ".host". -q --quiet . 250. --tldr cat-config "" . 255. --scale-svg= plot (: 1.0). 257. --detailed plot SVG . 257. --drm-device= chid sysfs DRM EDID . : /sys/class/drm/card1-HDMI-A-1/ 258. --debugger= unit-gdb. $SYSTEMD_DEBUGGER gdb(1). 258. -A --debugger-arguments= . 258. -h --help . --version . --no-pager (pager). 0 . compare-versions 12 0 11 . 0 1 . has-tpm2 0 TPM2 ( systemd). OR 1 ( ) 2 ( ) 4 ( ). TPM2 7. $SYSTEMD_LOG_LEVEL ( ). . ( ) emerg alert crit err warning notice info debug 0 7. syslog(3) . console syslog kmsg journal (: SYSTEMD_LOG_LEVEL=debug,console:info debug info). . $SYSTEMD_LOG_COLOR . tty . journalctl(1) . $SYSTEMD_LOG_TIME . . journalctl(1) . $SYSTEMD_LOG_LOCATION . . . . $SYSTEMD_LOG_TID . (TID). . . $SYSTEMD_LOG_TARGET . : console ( ) console-prefixed ( "" syslog(3) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg ) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg . . "true". systemd kmsg. $SYSTEMD_PAGER $PAGER --no-pager. $SYSTEMD_PAGER $PAGER. $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager. : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C. less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd. less(1) . $SYSTEMD_LESSCHARSET less ( "utf-8" UTF-8). $LESSCHARSET less systemd. $SYSTEMD_PAGERSECURE (pager) less(1) "" . sudo(8) pkexec(1) . . " " ( ). " " --no-pager PAGER=cat . . (true) " " . " " LESSSECURE=1 . less(1) " ". false (pager). SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd " " . " " geteuid(2) sd_pid_get_owner_uid(3) sudo(8) ($SUDO_UID [5]). SYSTEMD_PAGERSECURE=1 " " . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS (boolean) . ( ) systemd . $COLORTERM "truecolor" "24bit" 24 256 $NO_COLOR $TERM . true $NO_COLOR. false . "16" "256" "24bit" ANSI 16 256 24 . "auto-16" "auto-256" "auto-24bit" $TERM . $SYSTEMD_URLIFY . . systemd $TERM . 35. JSON JSON --security-policy= JSON . JSON : description_na ( ) description_good ( ) description_bad ( ) weight ( ) range ( ). JSON . : . 1 100 . 'security' . "0" . { "PrivateDevices": { "description_good": " ", "description_bad": " ", "weight": 1000, "range": 1 }, "PrivateMounts": { "description_good": " ", "description_bad": " ", "weight": 1000, "range": 1 }, "PrivateNetwork": { "description_good": " ", "description_bad": " ", "weight": 2500, "range": 1 }, "PrivateTmp": { "description_good": " ", "description_bad": " ", "weight": 1000, "range": 1 }, "PrivateUsers": { "description_good": " ", "description_bad": " ", "weight": 1000, "range": 1 } } systemd(1), systemctl(1) 1. https://systemd.io/PACKAGE_METADATA_FOR_EXECUTABLE_FILES/ 2. dlopen() ELF https://systemd.io/ELF_DLOPEN_METADATA/ 3. UAPI.2 https://uapi-group.org/specifications/specs/discoverable_partitions_specification 4. (CHIDs) https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/using-chids 5. $SUDO_UID . 3 . . : . systemd 260.1 SYSTEMD-ANALYZE(1)