SYSTEMD-ANALYZE(1) systemd-analyze SYSTEMD-ANALYZE(1) (NAME) systemd-analyze - systemd (SYNOPSIS) systemd-analyze [OPTIONS...] [time] systemd-analyze [OPTIONS...] blame systemd-analyze [OPTIONS...] critical-chain [UNIT...] systemd-analyze [OPTIONS...] dump [PATTERN...] systemd-analyze [OPTIONS...] plot [>file.svg] systemd-analyze [OPTIONS...] dot [PATTERN...] [>file.dot] systemd-analyze [OPTIONS...] unit-files systemd-analyze [OPTIONS...] unit-paths systemd-analyze [OPTIONS...] exit-status [STATUS...] systemd-analyze [OPTIONS...] capability [CAPABILITY... | {-m | --mask} MASK] systemd-analyze [OPTIONS...] condition CONDITION... systemd-analyze [OPTIONS...] syscall-filter [SET...] systemd-analyze [OPTIONS...] filesystems [SET...] systemd-analyze [OPTIONS...] calendar SPEC... systemd-analyze [OPTIONS...] timestamp TIMESTAMP... systemd-analyze [OPTIONS...] timespan SPAN... systemd-analyze [OPTIONS...] cat-config NAME|PATH... systemd-analyze [OPTIONS...] compare-versions VERSION1 [OP] VERSION2 systemd-analyze [OPTIONS...] verify FILE... systemd-analyze [OPTIONS...] security [UNIT...] systemd-analyze [OPTIONS...] inspect-elf FILE... systemd-analyze [OPTIONS...] malloc [D-BUS SERVICE...] systemd-analyze [OPTIONS...] fdstore UNIT... systemd-analyze [OPTIONS...] image-policy POLICY... systemd-analyze [OPTIONS...] has-tpm2 systemd-analyze [OPTIONS...] pcrs [PCR...] systemd-analyze [OPTIONS...] srk [>FILE] systemd-analyze [OPTIONS...] architectures [NAME...] systemd-analyze [OPTIONS...] smbios11 (DESCRIPTION) systemd-analyze () (unit files) . . systemd-analyze time . systemd-analyze time (kernel) (userspace) initrd . . . () # in a container $ systemd-analyze time Startup finished in 296ms (userspace) multi-user.target reached after 275ms in userspace # on a real machine $ systemd-analyze time Startup finished in 2.584s (kernel) + 19.176s (initrd) + 47.847s (userspace) = 1min 9.608s multi-user.target reached after 47.820s in userspace systemd-analyze blame . . . : systemd-analyze blame Type=simple systemd . (jobs) . "activating" (device units) "inactive" "active" . . . $ systemd-analyze blame 32.875s pmlogger.service 20.905s systemd-networkd-wait-online.service 13.299s dev-vda1.device ... 23ms sysroot.mount 11ms initrd-udevadm-cleanup-db.service 3ms sys-kernel-config.mount systemd-analyze critical-chain [UNIT...] ( UNIT ). "@" . "+" . . blame "activating" "activating" ( "inactive" "active" ) . ( ) . . systemd-analyze critical-chain $ systemd-analyze critical-chain multi-user.target @47.820s pmie.service @35.968s +548ms pmcd.service @33.715s +2.247s network-online.target @33.712s systemd-networkd-wait-online.service @12.804s +20.905s systemd-networkd.service @11.109s +1.690s systemd-udevd.service @9.201s +1.904s systemd-tmpfiles-setup-dev.service @7.306s +1.776s kmod-static-nodes.service @6.976s +177ms systemd-journald.socket system.slice -.slice systemd-analyze dump [pattern...] ( ) . glob . . () . . $ systemd-analyze --user dump Timestamp userspace: Thu 2019-03-14 23:28:07 CET Timestamp finish: Thu 2019-03-14 23:28:07 CET Timestamp generators-start: Thu 2019-03-14 23:28:07 CET Timestamp generators-finish: Thu 2019-03-14 23:28:07 CET Timestamp units-load-start: Thu 2019-03-14 23:28:07 CET Timestamp units-load-finish: Thu 2019-03-14 23:28:07 CET -> Unit proc-timer_list.mount: Description: /proc/timer_list ... -> Unit default.target: Description: Main user target ... systemd-analyze malloc [D-Bus service...] ( malloc_info(3) ) D-Bus . org.freedesktop.systemd1 ( ) . . org.freedesktop.MemoryAllocation1 . systemd . systemd-analyze plot SVG JSON . . (bootchart) $ systemd-analyze plot >bootup.svg $ eog bootup.svg& . . . ( ) . . systemd-analyze dot [pattern...] dot GraphViz dot(1) . systemd-analyze dot | dot -Tsvg >systemd.svg . --order --require . ( *.target) . . . "avahi-daemon" $ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg >avahi.svg $ eog avahi.svg . $ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' \ | dot -Tsvg >targets.svg $ eog targets.svg systemd-analyze unit-paths .d .wants .requires . --user --global . . $ systemd-analyze unit-paths | grep '^/run' /run/systemd/system.control /run/systemd/transient /run/systemd/generator.early /run/systemd/system /run/systemd/system.attached /run/systemd/generator /run/systemd/generator.late systemd-analyze . ( ) : systemctl [--user] [--global] show -p UnitPath --value systemd-analyze exit-status [STATUS...] <<>> ( "libc" "systemd" "LSB" "BSD") systemd.exec(5) . . . . $ systemd-analyze exit-status 0 1 {63..65} NAME STATUS CLASS SUCCESS 0 libc FAILURE 1 libc - 63 - USAGE 64 BSD DATAERR 65 BSD systemd-analyze capability [CAPABILITY... | {-m | --mask} MASK] . capabilities(7) . . "cap_???" . . --mask . . ( "/proc/PID/status") . . $ systemd-analyze capability 0 1 {30..32} NAME NUMBER cap_chown 0 cap_dac_override 1 cap_audit_control 30 cap_setfcap 31 cap_mac_override 32 . proc/ $ systemd-analyze capability -m 0000000000003c00 NAME NUMBER cap_net_bind_service 10 cap_net_broadcast 11 cap_net_admin 12 cap_net_raw 13 systemd-analyze condition CONDITION... Condition*=... Assert*=... . systemd.unit(5) . . $ systemd-analyze condition 'ConditionKernelVersion = ! <4.0' \ 'ConditionKernelVersion = >=5.1' \ 'ConditionACPower=|false' \ 'ConditionArchitecture=|!arm' \ 'AssertPathExists=/etc/os-release' test.service: AssertPathExists=/etc/os-release succeeded. Asserts succeeded. test.service: ConditionArchitecture=|!arm succeeded. test.service: ConditionACPower=|false failed. test.service: ConditionKernelVersion=>=5.1 succeeded. test.service: ConditionKernelVersion=!<4.0 succeeded. Conditions succeeded. systemd-analyze syscall-filter [SET...] SET . SET "@" . systemd-analyze filesystems [SET...] SET . SET "@" . systemd-analyze calendar EXPRESSION... () . OnCalendar= systemd.timer(5) systemd.time(7) . --iterations= . timestamp . . $ systemd-analyze calendar --iterations=5 '*-2-29 0:0:0' Original form: *-2-29 0:0:0 Normalized form: *-02-29 00:00:00 Next elapse: Sat 2020-02-29 00:00:00 UTC From now: 11 months 15 days left Iter. #2: Thu 2024-02-29 00:00:00 UTC From now: 4 years 11 months left Iter. #3: Tue 2028-02-29 00:00:00 UTC From now: 8 years 11 months left Iter. #4: Sun 2032-02-29 00:00:00 UTC From now: 12 years 11 months left Iter. #5: Fri 2036-02-29 00:00:00 UTC From now: 16 years 11 months left systemd-analyze timestamp TIMESTAMP... ( ) . systemd.time(7) "PARSING TIMESTAMPS" . . $ systemd-analyze timestamp yesterday now tomorrow Original form: yesterday Normalized form: Mon 2019-05-20 00:00:00 CEST (in UTC): Sun 2019-05-19 22:00:00 UTC UNIX seconds: @15583032000 From now: 1 day 9h ago Original form: now Normalized form: Tue 2019-05-21 09:48:39 CEST (in UTC): Tue 2019-05-21 07:48:39 UTC UNIX seconds: @1558424919.659757 From now: 43us ago Original form: tomorrow Normalized form: Wed 2019-05-22 00:00:00 CEST (in UTC): Tue 2019-05-21 22:00:00 UTC UNIX seconds: @15584760000 From now: 14h left systemd-analyze timespan EXPRESSION... ( ) . systemd.time(7) "PARSING TIME SPANS" . . . $ systemd-analyze timespan 1s 300s '1year 0.000001s' Original: 1s s: 1000000 Human: 1s Original: 300s s: 300000000 Human: 5min Original: 1year 0.000001s s: 31557600000001 Human: 1y 1us systemd-analyze cat-config NAME|PATH... systemctl cat . drop-in systemd . ( /etc/systemd/logind.conf /usr/lib/systemd/logind.conf) ( systemd/logind.conf) . . logind $ systemd-analyze cat-config systemd/logind.conf # /etc/systemd/logind.conf ... [Login] NAutoVTs=8 ... # /usr/lib/systemd/logind.conf.d/20-test.conf ... some override from another package # /etc/systemd/logind.conf.d/50-override.conf ... some administrator override systemd-analyze compare-versions VERSION1 [OP] VERSION2 OP . -- OP -- "VERSION1 < VERSION2" "VERSION1 == VERSION2" "VERSION1 > VERSION2" . 0 11 12 . ( rpmdev-vercmp .) -- OP -- OP 0 () 1 () . OP lt le eq ne ge gt . . ( --compare-versions dpkg(1) .) . $ systemd-analyze compare-versions systemd-250~rc1.fc36.aarch64 systemd-251.fc36.aarch64 systemd-250~rc1.fc36.aarch64 < systemd-251.fc36.aarch64 $ echo $? 12 $ systemd-analyze compare-versions 1 lt 2; echo $? 0 $ systemd-analyze compare-versions 1 ge 2; echo $? 1 systemd-analyze verify FILE... . . . . $SYSTEMD_UNIT_PATH systemd.unit(5) . . ( foo@.service) "test_instance" --instance= . : o o o Documentation= o ExecStart= . . $ cat ./user.slice [Unit] WhatIsThis=11 Documentation=man:nosuchfile(1) Requires=different.service [Service] Description=x $ systemd-analyze verify ./user.slice [./user.slice:9] Unknown lvalue 'WhatIsThis' in section 'Unit' [./user.slice:13] Unknown section 'Service'. Ignoring. Error: org.freedesktop.systemd1.LoadFailed: Unit different.service failed to load: No such file or directory. Failed to create user.slice/start: Invalid argument user.slice: man nosuchfile(1) command failed with code 16 . $ tail ./a.socket ./b.socket ==> ./a.socket <== [Socket] ListenStream=100 ==> ./b.socket <== [Socket] ListenStream=100 Accept=yes $ systemd-analyze verify ./a.socket ./b.socket Service a.service not loaded, a.socket cannot be started. Service b@0.service not loaded, b.socket cannot be started. . $ cat /tmp/source [Unit] Description=Hostname printer [Service] Type=simple ExecStart=/usr/bin/echo %H MysteryKey=true $ systemd-analyze verify /tmp/source Failed to prepare filename /tmp/source: Invalid argument $ systemd-analyze verify /tmp/source:alias.service alias.service:7: Unknown key name 'MysteryKey' in section 'Service', ignoring. systemd-analyze security [UNIT...] (sandboxing) . . . << >> (exposure level) . . . . . . systemd . . : . . -- . (mount points) . . . . ( D-Bus) . . . systemd-logind.service $ systemd-analyze security --no-pager systemd-logind.service NAME DESCRIPTION EXPOSURE PrivateNetwork= Service has access to the host's network 0.5 User=/DynamicUser= Service runs as root user 0.4 DeviceAllow= Service has no device ACL 0.2 \/ IPAddressDeny= Service blocks all IP address ranges ... -> Overall exposure level for systemd-logind.service: 4.1 OK systemd-analyze inspect-elf FILE... ELF ( core ) ( ) json . (Packaging Metadata)[1] . . core JSON $ systemd-analyze inspect-elf core.service.1000.5e02422a5e98450a9d391060932204eb.11478.1683820256000000 { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64", ... "packageMetadata" : { "systemd" : { "type" : "rpm", "name" : "systemd", "version" : "253", "release" : "8.fc38", "architecture" : "x86_64" } } } systemd-analyze fdstore UNIT... . inode inode . FileDescriptorStoreMax= systemd.service(5) . . $ systemd-analyze fdstore systemd-journald.service FDNAME TYPE DEVNO INODE RDEVNO PATH FLAGS stored sock 0:8 4218620 - socket:[4218620] ro stored sock 0:8 4213198 - socket:[4213198] ro stored sock 0:8 4213190 - socket:[4213190] ro ... : "DEVNO" / inode . "RDEVNO" / . .st_dev .st_rdev struct stat ( stat(2) ). inode "INODE" "DEVNO" . systemd-analyze image-policy POLICY... systemd.image-policy(7) . . ( (Discoverable Partitions Specification)[2]) . . $ systemd-analyze image-policy swap=encrypted:usr=read-only-on+verity:root=encrypted Analyzing policy: root=encrypted:usr=verity+read-only-on:swap=encrypted Long form: root=encrypted:usr=verity+read-only-on:swap=encrypted:=unused+absent PARTITION MODE READ-ONLY GROWFS root encrypted - - usr verity yes - home ignore - - srv ignore - - esp ignore - - xbootldr ignore - - swap encrypted - - root-verity ignore - - usr-verity unprotected yes - root-verity-sig ignore - - usr-verity-sig ignore - - tmp ignore - - var ignore - - default ignore - - systemd-analyze has-tpm2 TPM2 . TPM2 ( systemd) "yes" . // "no" . "partial" . . TPM2 // . : libtss2-esys.so.0 libtss2-rc.so.0 libtss2-mu.so.0. . TPM 2.0 TPM 1.2 . --quiet . . yes +firmware +driver +system +subsystem +libraries +libtss2-esys.so.0 +libtss2-rc.so.0 +libtss2-mu.so.0 . systemd-analyze pcrs [PCR...] PCR TPM2 . . $ systemd-analyze pcrs NR NAME SHA256 0 platform-code bcd2eb527108bbb1f5528409bcbe310aa9b74f687854cc5857605993f3d9eb11 1 platform-config b60622856eb7ce52637b80f30a520e6e87c347daa679f3335f4f1a600681bb01 2 external-code 1471262403e9a62f9c392941300b4807fbdb6f0bfdd50abfab752732087017dd 3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 4 boot-loader-code 939f7fa1458e1f7ce968874d908e524fc0debf890383d355e4ce347b7b78a95c 5 boot-loader-config 864c61c5ea5ecbdb6951e6cb6d9c1f4b4eac79772f7fe13b8bece569d83d3768 6 - 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 7 secure-boot-policy 9c905bd9b9891bfb889b90a54c4b537b889cfa817c4389cc25754823a9443255 8 - 0000000000000000000000000000000000000000000000000000000000000000 9 kernel-initrd 9caa29b128113ef42aa53d421f03437be57211e5ebafc0fa8b5d4514ee37ff0c 10 ima 5ea9e3dab53eb6b483b6ec9e3b2c712bea66bca1b155637841216e0094387400 11 kernel-boot 0000000000000000000000000000000000000000000000000000000000000000 12 kernel-config 627ffa4b405e911902fe1f1a8b0164693b31acab04f805f15bccfe2209c7eace 13 sysexts 0000000000000000000000000000000000000000000000000000000000000000 14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000 15 system-identity 0000000000000000000000000000000000000000000000000000000000000000 16 debug 0000000000000000000000000000000000000000000000000000000000000000 17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 23 application-support 0000000000000000000000000000000000000000000000000000000000000000 systemd-analyze srk [>FILE] (SRK) TPM2 TPM2B_PUBLIC . (pipe) . . srk.tpm2b_public systemd-analyze srk >srk.tpm2b_public systemd-analyze architectures [NAME...] CPU (native) . ConditionArchitecture= systemd.unit(5) . . . $ systemd-analyze architectures NAME SUPPORT alpha foreign arc foreign arc-be foreign arm foreign arm64 foreign ... sparc foreign sparc64 foreign tilegx foreign x86 secondary x86-64 native systemd-analyze smbios11 SMBIOS . smbios- type-11(7) . . $ systemd-analyze smbios11 io.systemd.stub.kernel-cmdline-extra=console=ttyS0 io.systemd.credential.binary:ssh.ephemeral-authorized_keys-all=c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSURGd20xbFp4WlRGclJteG9ZQlozOTYzcE1uYlJCaDMwM1MxVXhLSUM2NmYgbGVubmFydEB6ZXRhCg== io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042 3 SMBIOS Type #11 strings passed. . (OPTIONS) : --system systemd . . . --user systemd . . --global systemd . . --order, --require dot ( ) . --order After= Before= . --require Requires= Requisite= BindsTo= Wants= Conflicts= . . . --from-pattern=, --to-pattern= dot ( ) . glob(7) . . . . ( ) . . --fuzz=timespan critical-chain ( ) timespan . timespan "50ms". . --man=no man(1) Documentation= . . --generators (generators) systemd.generator(7) . . . . --instance=NAME . ( foo@.service) systemd-analyze condition --unit= systemd-analyze security systemd-analyze verify . "test_instance" . . --recursive-errors=MODE systemd-analyze verify . yes . no . one . . . --root=PATH cat-config verify condition security --offline= PATH . . --image=PATH cat-config verify condition security --offline= PATH . . --image-policy=policy systemd.image-policy(7). --image= ( ) . "*" . --offline=BOOL security security PID 1 . --offline= --root= --image= . --threshold= ( ) --offline= . . --profile=PATH security --offline= . drop-in . . --threshold=NUMBER security . security . --threshold= --offline= . . --security-policy=PATH security JSON () . . +---------------------------------------------------------+ |Assessment Test Identifier | +---------------------------------------------------------+ |UserOrDynamicUser | +---------------------------------------------------------+ |SupplementaryGroups | +---------------------------------------------------------+ |PrivateMounts | +---------------------------------------------------------+ |PrivateDevices | +---------------------------------------------------------+ |PrivateTmp | +---------------------------------------------------------+ |PrivateNetwork | +---------------------------------------------------------+ |PrivateUsers | +---------------------------------------------------------+ |ProtectControlGroups | +---------------------------------------------------------+ |ProtectKernelModules | +---------------------------------------------------------+ |ProtectKernelTunables | +---------------------------------------------------------+ |ProtectKernelLogs | +---------------------------------------------------------+ |ProtectClock | +---------------------------------------------------------+ |ProtectHome | +---------------------------------------------------------+ |ProtectHostname | +---------------------------------------------------------+ |ProtectSystem | +---------------------------------------------------------+ |RootDirectoryOrRootImage | +---------------------------------------------------------+ |LockPersonality | +---------------------------------------------------------+ |MemoryDenyWriteExecute | +---------------------------------------------------------+ |NoNewPrivileges | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_ADMIN | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SET_UID_GID_PCAP | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_PTRACE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_TIME | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_NET_ADMIN | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_RAWIO | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_MODULE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_AUDIT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYSLOG | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_MKNOD | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_KILL | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_BOOT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_MAC | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_LINUX_IMMUTABLE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_IPC_LOCK | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_CHROOT | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_BLOCK_SUSPEND | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_WAKE_ALARM | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_LEASE | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_SYS_TTY_CONFIG | +---------------------------------------------------------+ |CapabilityBoundingSet_CAP_BPF | +---------------------------------------------------------+ |UMask | +---------------------------------------------------------+ |KeyringMode | +---------------------------------------------------------+ |ProtectProc | +---------------------------------------------------------+ |ProcSubset | +---------------------------------------------------------+ |NotifyAccess | +---------------------------------------------------------+ |RemoveIPC | +---------------------------------------------------------+ |Delegate | +---------------------------------------------------------+ |RestrictRealtime | +---------------------------------------------------------+ |RestrictSUIDSGID | +---------------------------------------------------------+ |RestrictNamespaces_user | +---------------------------------------------------------+ |RestrictNamespaces_mnt | +---------------------------------------------------------+ |RestrictNamespaces_ipc | +---------------------------------------------------------+ |RestrictNamespaces_pid | +---------------------------------------------------------+ |RestrictNamespaces_cgroup | +---------------------------------------------------------+ |RestrictNamespaces_uts | +---------------------------------------------------------+ |RestrictNamespaces_net | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_INET_INET6 | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_UNIX | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_NETLINK | +---------------------------------------------------------+ |RestrictAddressFamilies_AF_PACKET | +---------------------------------------------------------+ |RestrictAddressFamilies_OTHER | +---------------------------------------------------------+ |SystemCallArchitectures | +---------------------------------------------------------+ |SystemCallFilter_swap | +---------------------------------------------------------+ |SystemCallFilter_obsolete | +---------------------------------------------------------+ |SystemCallFilter_clock | +---------------------------------------------------------+ |SystemCallFilter_cpu_emulation | +---------------------------------------------------------+ |SystemCallFilter_debug | +---------------------------------------------------------+ |SystemCallFilter_mount | +---------------------------------------------------------+ |SystemCallFilter_module | +---------------------------------------------------------+ |SystemCallFilter_raw_io | +---------------------------------------------------------+ |SystemCallFilter_reboot | +---------------------------------------------------------+ |SystemCallFilter_privileged | +---------------------------------------------------------+ |SystemCallFilter_resources | +---------------------------------------------------------+ |IPAddressDeny | +---------------------------------------------------------+ |DeviceAllow | +---------------------------------------------------------+ |AmbientCapabilities | +---------------------------------------------------------+ << JSON>> . . --json=MODE security JSON . JSON : set name json_field JSON description exposure . . . JSON . MODE : off pretty short JSON . plot JSON . JSON : name activated activating time deactivated deactivating . . --iterations=NUMBER calendar . . . --base-time=TIMESTAMP calendar . . . --unit=UNIT condition Condition*=... Assert*=... . . $SYSTEMD_UNIT_PATH systemd.unit(5) . . ( foo@.service) "test_instance" --instance= . . --table plot . . --no-legend plot --table --json= . . -H, --host= . "@" . ssh ":" "/" . SSH . machinectl -H HOST . IPv6 . -M, --machine= . "@" . ".host" ( : "--user --machine=lennart@.host"). "@" . "@" ( ) ".host" . -q, --quiet . . --tldr cat-config <<>> . . --scale-svg=FACTOR plot (x) FACTOR (: .). . --detailed plot SVG . . -h, --help . --version . --no-pager (pager) . (EXIT STATUS) 0 . compare-versions 12 0 11 . 0 1 . has-tpm2 TPM2 ( systemd) 0 . OR 1 ( ) 2 ( ) 4 ( ) . TPM2 7 . (ENVIRONMENT) $SYSTEMD_LOG_LEVEL () ( ). . ( ) : emerg alert crit err warning notice info debug . syslog(3) . console syslog kmsg journal ( SYSTEMD_LOG_LEVEL=debug,console:info debug info ). . $SYSTEMD_LOG_COLOR (boolean). (true) tty . journalctl(1) . $SYSTEMD_LOG_TIME . . journalctl(1) . $SYSTEMD_LOG_LOCATION . . . . $SYSTEMD_LOG_TID . (TID) . . . $SYSTEMD_LOG_TARGET . : console ( tty ) console-prefixed ( tty syslog(3) ) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg . . "true" . systemd kmsg . $SYSTEMD_PAGER, $PAGER --no-pager . $SYSTEMD_PAGER $PAGER . $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager . : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C . less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd . less(1) . $SYSTEMD_LESSCHARSET less ( "utf-8" UTF-8 ). $LESSCHARSET less systemd . $SYSTEMD_PAGERSECURE less(1) <<>> () . sudo(8) pkexec(1) . . << >> ( ). << >> --no-pager PAGER=cat . . true << >> . << >> LESSSECURE=1 . less(1) << >> . false . SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd << >> . (UID) ( geteuid(2) sd_pid_get_owner_uid(3) ) sudo(8) ( $SUDO_UID [3]) << >> . SYSTEMD_PAGERSECURE=1 << >> . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS . (true) systemd . : "16" "256" ANSI . $TERM . $SYSTEMD_URLIFY . . systemd $TERM . (EXAMPLES) . JSON (JSON Policy) JSON --security-policy= JSON . JSON : description_na () description_good () description_bad () weight ( ) range ( ). JSON . (weight) (range) : (badness score) . . 'security' . "0" . { "PrivateDevices": { "description_good": "Service has no access to hardware devices", "description_bad": "Service potentially has access to hardware devices", "weight": 1000, "range": 1 }, "PrivateMounts": { "description_good": "Service cannot install system mounts", "description_bad": "Service may install system mounts", "weight": 1000, "range": 1 }, "PrivateNetwork": { "description_good": "Service has no access to the host's network", "description_bad": "Service has access to the host's network", "weight": 2500, "range": 1 }, "PrivateTmp": { "description_good": "Service has no access to other software's temporary files", "description_bad": "Service has access to other software's temporary files", "weight": 1000, "range": 1 }, "PrivateUsers": { "description_good": "Service does not have access to other users", "description_bad": "Service has access to other users", "weight": 1000, "range": 1 } } (SEE ALSO) systemd(1), systemctl(1) (NOTES) 1. (Packaging Metadata) https://systemd.io/COREDUMP_PACKAGE_METADATA/ 2. (Discoverable Partitions Specification) https://uapi- group.org/specifications/specs/discoverable_partitions_specification 3. $SUDO_UID . systemd 257.13 SYSTEMD-ANALYZE(1)