01 / 03
1. Identify the host and service
- Run hostname and date -Is; compare the host with the incident inventory.
- Run systemctl list-units --type=service --state=running and locate the exact service name used on this host.
- Run systemctl status SERVICE --no-pager, substituting that name.
- Before you use it
- Confirm that these are the service names on your host.
systemctl is-active apache2 mariadbCaptured demo response · 2026-11-04T08:36:24.024456Z. Any filtering, hidden values or test-only data are identified in the capture label. Select Replay transcript to read the recorded output.
- Success looks like
- The lab returned active for both services at 08:36 UTC on November 4, 2026.
- Stop if
- If a unit is inactive or unknown, inspect its exact name and status before taking action.
Observed web and database service states
Open to enlargeCapture details
This inspection does not establish a completed call or restore.You should seeActive indicates systemd's current unit state, not proof that the application works. A missing unit may have another name or may not be managed by systemd.
02 / 03
2. Inspect the incident window
- For the lab web service, run journalctl -u apache2 --since '30 minutes ago' --no-pager. Replace apache2 with the exact unit found on your host; output and incident times may differ.
- Compare timestamps with the incident and note repeated errors, exit status and dependencies.
- Inspect application-specific logs only where the service owner identifies them; avoid copying credentials or customer data.
You should seeAn error near the incident is a lead to investigate, not automatically the root cause. An empty journal can mean the application logs elsewhere.
03 / 03
3. Check the application
- From an approved client run curl --fail --show-error --head https://YOUR_HOSTNAME/ with the actual HTTPS host, then compare the response with the web service status. A response does not establish login or call audio.
- If the service is failed, capture a redacted status and incident time for the owner.
- Do not restart or change the service until the owner approves a maintenance action.
You should seeService health and application behavior should be checked separately.
Checks and sources
What was checked
- Both samples here only observe: `systemctl status` and `journalctl` never start, stop, enable or restart a unit.
Primary references
Sources
- systemctl manualsystemd · accessed November 4, 2026
- journalctl manualsystemd · accessed November 4, 2026
