I have a service (written by myself) running on a Debian (Jessie) server, and the service's own logs happen to indicate that it restarted at a particular time. There is no indication of a segfault or other crash, so I am now trying to figure out if the application somehow silently failed and got respawned by systemd, or whether a user purposely restarted the service via systemctl.
The shell history doesn't show such activity, but that is not conclusive because of export HISTCONTROL=ignoreboth and because an SSH session might have just timed out, preventing a previous login's bash history from being written to disk. The server was not rebooted at the time.
But I would expect that systemd itself should keep a log indicating when a service was purposely restarted. To my surprise I was unable to find any documentation (e.g. for journalctl) on how to get such logs.
Some other posts (e.g. Where is / why is there no log for normal user systemd services?) seem to indicate that there should be log messages like this:
Jan 15 19:28:08 qbd-x230-suse.site systemd[1]: Starting chatty.service...
Jan 15 19:28:08 qbd-x230-suse.site systemd[1]: Started chatty.service.
But I don't see such log messages on my system.
Is there a way to find out when systemd services were started, stopped or restarted?
Edit: It seems the typical problem people might run into is that they run journalctl as a non-privileged user. This is not the case for me, I have been operating as root the whole time. In response to a comment, running grep systemd /var/log/syslog gives me only this:
Jun 6 09:28:35 server systemd[22057]: Starting Paths.
Jun 6 09:28:35 server systemd[22057]: Reached target Paths.
Jun 6 09:28:35 server systemd[22057]: Starting Timers.
Jun 6 09:28:35 server systemd[22057]: Reached target Timers.
Jun 6 09:28:35 server systemd[22057]: Starting Sockets.
Jun 6 09:28:35 server systemd[22057]: Reached target Sockets.
Jun 6 09:28:35 server systemd[22057]: Starting Basic System.
Jun 6 09:28:35 server systemd[22057]: Reached target Basic System.
Jun 6 09:28:35 server systemd[22057]: Starting Default.
Jun 6 09:28:35 server systemd[22057]: Reached target Default.
Jun 6 09:28:35 server systemd[22057]: Startup finished in 59ms.
Jun 6 09:37:08 server systemd[1]: Reexecuting.
Best Answer
If you need to script this, you should look into using the
systemctl showcommand. It is more useful for scripts than trying to parse anything fromstatus. For example, to find when the service last started you can use:If you would like to see all the properties available just omit the flag and it will dump them all out.
The documentation for these properties can be found here.