daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
Brian Stinson 2593d8
From a2e00522971897909db2a81b4daf10e5700f453e Mon Sep 17 00:00:00 2001
Brian Stinson 2593d8
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Brian Stinson 2593d8
Date: Fri, 15 Mar 2019 10:13:55 +0100
Brian Stinson 2593d8
Subject: [PATCH] man: reorder and add examples to systemd-analyze(1)
Brian Stinson 2593d8
Brian Stinson 2593d8
The number of verbs supported by systemd-analyze has grown quite a bit, and the
Brian Stinson 2593d8
man page has become an unreadable wall of text. Let's put each verb in a
Brian Stinson 2593d8
separate subsection, grouping similar verbs together, and add a lot of examples
Brian Stinson 2593d8
to guide the user.
Brian Stinson 2593d8
Brian Stinson 2593d8
(cherry picked from commit d323a99001c1f7625e8ac902e18deb514a4ca18d)
Brian Stinson 2593d8
Brian Stinson 2593d8
Related: #1750343
Brian Stinson 2593d8
---
Brian Stinson 2593d8
 man/systemd-analyze.xml | 678 +++++++++++++++++++++++++---------------
Brian Stinson 2593d8
 1 file changed, 429 insertions(+), 249 deletions(-)
Brian Stinson 2593d8
Brian Stinson 2593d8
diff --git a/man/systemd-analyze.xml b/man/systemd-analyze.xml
Brian Stinson 2593d8
index f3b595880f..7c873cbdd1 100644
Brian Stinson 2593d8
--- a/man/systemd-analyze.xml
Brian Stinson 2593d8
+++ b/man/systemd-analyze.xml
Brian Stinson 2593d8
@@ -41,46 +41,50 @@
Brian Stinson 2593d8
       <arg choice="plain">critical-chain</arg>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat"><replaceable>UNIT</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">plot</arg>
Brian Stinson 2593d8
-      <arg choice="opt">> file.svg</arg>
Brian Stinson 2593d8
+      <arg choice="plain">log-level</arg>
Brian Stinson 2593d8
+      <arg choice="opt"><replaceable>LEVEL</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">dot</arg>
Brian Stinson 2593d8
-      <arg choice="opt" rep="repeat"><replaceable>PATTERN</replaceable></arg>
Brian Stinson 2593d8
-      <arg choice="opt">> file.dot</arg>
Brian Stinson 2593d8
+      <arg choice="plain">log-target</arg>
Brian Stinson 2593d8
+      <arg choice="opt"><replaceable>TARGET</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">dump</arg>
Brian Stinson 2593d8
+      <arg choice="plain">service-watchdogs</arg>
Brian Stinson 2593d8
+      <arg choice="opt"><replaceable>BOOL</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">cat-config</arg>
Brian Stinson 2593d8
-      <arg choice="plain" rep="repeat"><replaceable>NAME</replaceable>|<replaceable>PATH</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">dump</arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">unit-paths</arg>
Brian Stinson 2593d8
+      <arg choice="plain">plot</arg>
Brian Stinson 2593d8
+      <arg choice="opt">>file.svg</arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">log-level</arg>
Brian Stinson 2593d8
-      <arg choice="opt"><replaceable>LEVEL</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">dot</arg>
Brian Stinson 2593d8
+      <arg choice="opt" rep="repeat"><replaceable>PATTERN</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="opt">>file.dot</arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">log-target</arg>
Brian Stinson 2593d8
-      <arg choice="opt"><replaceable>TARGET</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">unit-paths</arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
@@ -91,20 +95,20 @@
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">verify</arg>
Brian Stinson 2593d8
-      <arg choice="opt" rep="repeat"><replaceable>FILES</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">calendar</arg>
Brian Stinson 2593d8
+      <arg choice="plain" rep="repeat"><replaceable>SPECS</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">calendar</arg>
Brian Stinson 2593d8
-      <arg choice="plain" rep="repeat"><replaceable>SPECS</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">timespan</arg>
Brian Stinson 2593d8
+      <arg choice="plain" rep="repeat"><replaceable>SPAN</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
       <arg choice="opt" rep="repeat">OPTIONS</arg>
Brian Stinson 2593d8
-      <arg choice="plain">service-watchdogs</arg>
Brian Stinson 2593d8
-      <arg choice="opt"><replaceable>BOOL</replaceable></arg>
Brian Stinson 2593d8
+      <arg choice="plain">cat-config</arg>
Brian Stinson 2593d8
+      <arg choice="plain" rep="repeat"><replaceable>NAME</replaceable>|<replaceable>PATH</replaceable></arg>
Brian Stinson 2593d8
     </cmdsynopsis>
Brian Stinson 2593d8
     <cmdsynopsis>
Brian Stinson 2593d8
       <command>systemd-analyze</command>
Brian Stinson 2593d8
@@ -123,73 +127,299 @@
Brian Stinson 2593d8
     verify the correctness of unit files. It is also used to access
Brian Stinson 2593d8
     special functions useful for advanced system manager debugging.</para>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-    <para><command>systemd-analyze time</command> prints the time
Brian Stinson 2593d8
-    spent in the kernel before userspace has been reached, the time
Brian Stinson 2593d8
-    spent in the initial RAM disk (initrd) before normal system
Brian Stinson 2593d8
-    userspace has been reached, and the time normal system userspace
Brian Stinson 2593d8
-    took to initialize. Note that these measurements simply measure
Brian Stinson 2593d8
-    the time passed up to the point where all system services have
Brian Stinson 2593d8
-    been spawned, but not necessarily until they fully finished
Brian Stinson 2593d8
-    initialization or the disk is idle.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze blame</command> prints a list of
Brian Stinson 2593d8
-    all running units, ordered by the time they took to initialize.
Brian Stinson 2593d8
-    This information may be used to optimize boot-up times. Note that
Brian Stinson 2593d8
-    the output might be misleading as the initialization of one
Brian Stinson 2593d8
-    service might be slow simply because it waits for the
Brian Stinson 2593d8
-    initialization of another service to complete.
Brian Stinson 2593d8
-    Also note: <command>systemd-analyze blame</command> doesn't display
Brian Stinson 2593d8
-    results for services with <varname>Type=simple</varname>,
Brian Stinson 2593d8
-    because systemd considers such services to be started immediately,
Brian Stinson 2593d8
-    hence no measurement of the initialization delays can be done.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze critical-chain
Brian Stinson 2593d8
-    [<replaceable>UNIT…</replaceable>]</command> prints a tree of
Brian Stinson 2593d8
-    the time-critical chain of units (for each of the specified
Brian Stinson 2593d8
-    <replaceable>UNIT</replaceable>s or for the default target
Brian Stinson 2593d8
-    otherwise). The time after the unit is active or started is
Brian Stinson 2593d8
-    printed after the "@" character. The time the unit takes to start
Brian Stinson 2593d8
-    is printed after the "+" character. Note that the output might be
Brian Stinson 2593d8
-    misleading as the initialization of one service might depend on
Brian Stinson 2593d8
-    socket activation and because of the parallel execution of
Brian Stinson 2593d8
-    units.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze plot</command> prints an SVG
Brian Stinson 2593d8
-    graphic detailing which system services have been started at what
Brian Stinson 2593d8
-    time, highlighting the time they spent on initialization.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze dot</command> generates textual
Brian Stinson 2593d8
-    dependency graph description in dot format for further processing
Brian Stinson 2593d8
-    with the GraphViz
Brian Stinson 2593d8
-    <citerefentry project='die-net'><refentrytitle>dot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
Brian Stinson 2593d8
-    tool. Use a command line like <command>systemd-analyze dot | dot
Brian Stinson 2593d8
-    -Tsvg > systemd.svg</command> to generate a graphical dependency
Brian Stinson 2593d8
-    tree. Unless <option>--order</option> or
Brian Stinson 2593d8
-    <option>--require</option> is passed, the generated graph will
Brian Stinson 2593d8
-    show both ordering and requirement dependencies. Optional pattern
Brian Stinson 2593d8
-    globbing style specifications (e.g. <filename>*.target</filename>)
Brian Stinson 2593d8
-    may be given at the end. A unit dependency is included in the
Brian Stinson 2593d8
-    graph if any of these patterns match either the origin or
Brian Stinson 2593d8
-    destination node.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze dump</command> outputs a (usually
Brian Stinson 2593d8
-    very long) human-readable serialization of the complete server
Brian Stinson 2593d8
-    state. Its format is subject to change without notice and should
Brian Stinson 2593d8
-    not be parsed by applications.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze cat-config</command> is similar
Brian Stinson 2593d8
-    to <command>systemctl cat</command>, but operates on config files.
Brian Stinson 2593d8
-    It will copy the contents of a config file and any drop-ins to standard
Brian Stinson 2593d8
-    output, using the usual systemd set of directories and rules for
Brian Stinson 2593d8
-    precedence. Each argument must be either an absolute path including
Brian Stinson 2593d8
-    the prefix (such as <filename>/etc/systemd/logind.conf</filename> or
Brian Stinson 2593d8
-    <filename>/usr/lib/systemd/logind.conf</filename>), or a name
Brian Stinson 2593d8
-    relative to the prefix (such as <filename>systemd/logind.conf</filename>).
Brian Stinson 2593d8
-    </para>
Brian Stinson 2593d8
+    <para>If no command is passed, <command>systemd-analyze
Brian Stinson 2593d8
+    time</command> is implied.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze time</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command prints the time spent in the kernel before userspace has been reached, the time
Brian Stinson 2593d8
+      spent in the initial RAM disk (initrd) before normal system userspace has been reached, and the time
Brian Stinson 2593d8
+      normal system userspace took to initialize. Note that these measurements simply measure the time passed
Brian Stinson 2593d8
+      up to the point where all system services have been spawned, but not necessarily until they fully
Brian Stinson 2593d8
+      finished initialization or the disk is idle.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title><command>Show how long the boot took</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting># in a container
Brian Stinson 2593d8
+$ systemd-analyze time
Brian Stinson 2593d8
+Startup finished in 296ms (userspace)
Brian Stinson 2593d8
+multi-user.target reached after 275ms in userspace
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+# on a real machine
Brian Stinson 2593d8
+$ systemd-analyze time
Brian Stinson 2593d8
+Startup finished in 2.584s (kernel) + 19.176s (initrd) + 47.847s (userspace) = 1min 9.608s
Brian Stinson 2593d8
+multi-user.target reached after 47.820s in userspace
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze blame</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command prints a list of all running units, ordered by the time they took to initialize.
Brian Stinson 2593d8
+      This information may be used to optimize boot-up times. Note that the output might be misleading as the
Brian Stinson 2593d8
+      initialization of one service might be slow simply because it waits for the initialization of another
Brian Stinson 2593d8
+      service to complete.  Also note: <command>systemd-analyze blame</command> doesn't display results for
Brian Stinson 2593d8
+      services with <varname>Type=simple</varname>, because systemd considers such services to be started
Brian Stinson 2593d8
+      immediately, hence no measurement of the initialization delays can be done.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title><command>Show which units took the most time during boot</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze blame
Brian Stinson 2593d8
+         32.875s pmlogger.service
Brian Stinson 2593d8
+         20.905s systemd-networkd-wait-online.service
Brian Stinson 2593d8
+         13.299s dev-vda1.device
Brian Stinson 2593d8
+         ...
Brian Stinson 2593d8
+            23ms sysroot.mount
Brian Stinson 2593d8
+            11ms initrd-udevadm-cleanup-db.service
Brian Stinson 2593d8
+             3ms sys-kernel-config.mount
Brian Stinson 2593d8
+        </programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze critical-chain <optional><replaceable>UNIT</replaceable>...</optional></command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command prints a tree of the time-critical chain of units (for each of the specified
Brian Stinson 2593d8
+      <replaceable>UNIT</replaceable>s or for the default target otherwise). The time after the unit is
Brian Stinson 2593d8
+      active or started is printed after the "@" character. The time the unit takes to start is printed after
Brian Stinson 2593d8
+      the "+" character. Note that the output might be misleading as the initialization of services might
Brian Stinson 2593d8
+      depend on socket activation and because of the parallel execution of units.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title><command>systemd-analyze time</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <programlisting>$ systemd-analyze critical-chain
Brian Stinson 2593d8
+multi-user.target @47.820s
Brian Stinson 2593d8
+└─pmie.service @35.968s +548ms
Brian Stinson 2593d8
+  └─pmcd.service @33.715s +2.247s
Brian Stinson 2593d8
+    └─network-online.target @33.712s
Brian Stinson 2593d8
+      └─systemd-networkd-wait-online.service @12.804s +20.905s
Brian Stinson 2593d8
+        └─systemd-networkd.service @11.109s +1.690s
Brian Stinson 2593d8
+          └─systemd-udevd.service @9.201s +1.904s
Brian Stinson 2593d8
+            └─systemd-tmpfiles-setup-dev.service @7.306s +1.776s
Brian Stinson 2593d8
+              └─kmod-static-nodes.service @6.976s +177ms
Brian Stinson 2593d8
+                └─systemd-journald.socket
Brian Stinson 2593d8
+                  └─system.slice
Brian Stinson 2593d8
+                    └─-.slice
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze log-level [<replaceable>LEVEL</replaceable>]</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para><command>systemd-analyze log-level</command> prints the current log level of the
Brian Stinson 2593d8
+      <command>systemd</command> daemon.  If an optional argument <replaceable>LEVEL</replaceable> is
Brian Stinson 2593d8
+      provided, then the command changes the current log level of the <command>systemd</command> daemon to
Brian Stinson 2593d8
+      <replaceable>LEVEL</replaceable> (accepts the same values as <option>--log-level=</option> described in
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze log-target [<replaceable>TARGET</replaceable>]</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para><command>systemd-analyze log-target</command> prints the current log target of the
Brian Stinson 2593d8
+      <command>systemd</command> daemon.  If an optional argument <replaceable>TARGET</replaceable> is
Brian Stinson 2593d8
+      provided, then the command changes the current log target of the <command>systemd</command> daemon to
Brian Stinson 2593d8
+      <replaceable>TARGET</replaceable> (accepts the same values as <option>--log-target=</option>, described
Brian Stinson 2593d8
+      in <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze service-watchdogs [yes|no]</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para><command>systemd-analyze service-watchdogs</command> prints the current state of service runtime
Brian Stinson 2593d8
+      watchdogs of the <command>systemd</command> daemon. If an optional boolean argument is provided, then
Brian Stinson 2593d8
+      globally enables or disables the service runtime watchdogs (<option>WatchdogSec=</option>) and
Brian Stinson 2593d8
+      emergency actions (e.g.  <option>OnFailure=</option> or <option>StartLimitAction=</option>); see
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
Brian Stinson 2593d8
+      The hardware watchdog is not affected by this setting.</para>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze dump</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command outputs a (usually very long) human-readable serialization of the complete server
Brian Stinson 2593d8
+      state. Its format is subject to change without notice and should not be parsed by applications.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Show the internal state of user manager</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze --user dump
Brian Stinson 2593d8
+Timestamp userspace: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+Timestamp finish: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+Timestamp generators-start: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+Timestamp generators-finish: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+Timestamp units-load-start: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+Timestamp units-load-finish: Thu 2019-03-14 23:28:07 CET
Brian Stinson 2593d8
+-> Unit proc-timer_list.mount:
Brian Stinson 2593d8
+        Description: /proc/timer_list
Brian Stinson 2593d8
+        ...
Brian Stinson 2593d8
+-> Unit default.target:
Brian Stinson 2593d8
+        Description: Main user target
Brian Stinson 2593d8
+...
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze plot</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command prints an SVG graphic detailing which system services have been started at what
Brian Stinson 2593d8
+      time, highlighting the time they spent on initialization.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title><command>Plot a bootchart</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze plot >bootup.svg
Brian Stinson 2593d8
+$ eog bootup.svg&
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze dot [<replaceable>pattern</replaceable>...]</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command generates textual dependency graph description in dot format for further processing
Brian Stinson 2593d8
+      with the GraphViz
Brian Stinson 2593d8
+      <citerefentry project='die-net'><refentrytitle>dot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
Brian Stinson 2593d8
+      tool. Use a command line like <command>systemd-analyze dot | dot -Tsvg >systemd.svg</command> to
Brian Stinson 2593d8
+      generate a graphical dependency tree. Unless <option>--order</option> or <option>--require</option> is
Brian Stinson 2593d8
+      passed, the generated graph will show both ordering and requirement dependencies. Optional pattern
Brian Stinson 2593d8
+      globbing style specifications (e.g. <filename>*.target</filename>) may be given at the end. A unit
Brian Stinson 2593d8
+      dependency is included in the graph if any of these patterns match either the origin or destination
Brian Stinson 2593d8
+      node.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Plot all dependencies of any unit whose name starts with <literal>avahi-daemon</literal>
Brian Stinson 2593d8
+        </title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg >avahi.svg
Brian Stinson 2593d8
+$ eog avahi.svg</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Plot the dependencies between all known target units</title>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-    <example>
Brian Stinson 2593d8
-      <title>Showing logind configuration</title>
Brian Stinson 2593d8
-      <programlisting>$ systemd-analyze cat-config systemd/logind.conf
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' \
Brian Stinson 2593d8
+      | dot -Tsvg >targets.svg
Brian Stinson 2593d8
+$ eog targets.svg</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze unit-paths</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command outputs a list of all directories from which unit files, <filename>.d</filename>
Brian Stinson 2593d8
+      overrides, and <filename>.wants</filename>, <filename>.requires</filename> symlinks may be
Brian Stinson 2593d8
+      loaded. Combine with <option>--user</option> to retrieve the list for the user manager instance, and
Brian Stinson 2593d8
+      <option>--global</option> for the global configuration of user manager instances.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title><command>Show all paths for generated units</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze unit-paths | grep '^/run'
Brian Stinson 2593d8
+/run/systemd/system.control
Brian Stinson 2593d8
+/run/systemd/transient
Brian Stinson 2593d8
+/run/systemd/generator.early
Brian Stinson 2593d8
+/run/systemd/system
Brian Stinson 2593d8
+/run/systemd/system.attached
Brian Stinson 2593d8
+/run/systemd/generator
Brian Stinson 2593d8
+/run/systemd/generator.late
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>Note that this verb prints the list that is compiled into <command>systemd-analyze</command>
Brian Stinson 2593d8
+      itself, and does not comunicate with the running manager. Use
Brian Stinson 2593d8
+      <programlisting>systemctl [--user] [--global] show -p UnitPath --value</programlisting>
Brian Stinson 2593d8
+      to retrieve the actual list that the manager uses, with any empty directories omitted.</para>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze syscall-filter <optional><replaceable>SET</replaceable>...</optional></command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command will list system calls contained in the specified system call set
Brian Stinson 2593d8
+      <replaceable>SET</replaceable>, or all known sets if no sets are specified. Argument
Brian Stinson 2593d8
+      <replaceable>SET</replaceable> must include the <literal>@</literal> prefix.</para>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze calendar <replaceable>EXPRESSION</replaceable>...</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command will parse and normalize repetitive calendar time events, and will calculate when
Brian Stinson 2593d8
+      they elapse next. This takes the same input as the <varname>OnCalendar=</varname> setting in
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
Brian Stinson 2593d8
+      following the syntax described in
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. By
Brian Stinson 2593d8
+      default, only the next time the calendar expression will elapse is shown; use
Brian Stinson 2593d8
+      <option>--iterations=</option> to show the specified number of next times the expression
Brian Stinson 2593d8
+      elapses.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Show leap days in the near future</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze calendar --iterations=5 '*-2-29 0:0:0'
Brian Stinson 2593d8
+  Original form: *-2-29 0:0:0
Brian Stinson 2593d8
+Normalized form: *-02-29 00:00:00
Brian Stinson 2593d8
+    Next elapse: Sat 2020-02-29 00:00:00 UTC
Brian Stinson 2593d8
+       From now: 11 months 15 days left
Brian Stinson 2593d8
+       Iter. #2: Thu 2024-02-29 00:00:00 UTC
Brian Stinson 2593d8
+       From now: 4 years 11 months left
Brian Stinson 2593d8
+       Iter. #3: Tue 2028-02-29 00:00:00 UTC
Brian Stinson 2593d8
+       From now: 8 years 11 months left
Brian Stinson 2593d8
+       Iter. #4: Sun 2032-02-29 00:00:00 UTC
Brian Stinson 2593d8
+       From now: 12 years 11 months left
Brian Stinson 2593d8
+       Iter. #5: Fri 2036-02-29 00:00:00 UTC
Brian Stinson 2593d8
+       From now: 16 years 11 months left
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze timespan <replaceable>EXPRESSION</replaceable>...</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command parses a time span and outputs the normalized form and the equivalent value in
Brian Stinson 2593d8
+      microseconds. The time span should adhere to the same syntax documented in
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
Brian Stinson 2593d8
+      Values without associated magnitudes are parsed as seconds.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Show parsing of timespans</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze timespan 1s 300s '1year 0.000001s'
Brian Stinson 2593d8
+Original: 1s
Brian Stinson 2593d8
+      μs: 1000000
Brian Stinson 2593d8
+   Human: 1s
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+Original: 300s
Brian Stinson 2593d8
+      μs: 300000000
Brian Stinson 2593d8
+   Human: 5min
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+Original: 1year 0.000001s
Brian Stinson 2593d8
+      μs: 31557600000001
Brian Stinson 2593d8
+   Human: 1y 1us
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze cat-config</command>
Brian Stinson 2593d8
+      <replaceable>NAME</replaceable>|<replaceable>PATH</replaceable>...</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command is similar to <command>systemctl cat</command>, but operates on config files. It
Brian Stinson 2593d8
+      will copy the contents of a config file and any drop-ins to standard output, using the usual systemd
Brian Stinson 2593d8
+      set of directories and rules for precedence. Each argument must be either an absolute path including
Brian Stinson 2593d8
+      the prefix (such as <filename>/etc/systemd/logind.conf</filename> or
Brian Stinson 2593d8
+      <filename>/usr/lib/systemd/logind.conf</filename>), or a name relative to the prefix (such as
Brian Stinson 2593d8
+      <filename>systemd/logind.conf</filename>).</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Showing logind configuration</title>
Brian Stinson 2593d8
+        <programlisting>$ systemd-analyze cat-config systemd/logind.conf
Brian Stinson 2593d8
 # /etc/systemd/logind.conf
Brian Stinson 2593d8
 ...
Brian Stinson 2593d8
 [Login]
Brian Stinson 2593d8
@@ -201,90 +431,122 @@ NAutoVTs=8
Brian Stinson 2593d8
 
Brian Stinson 2593d8
 # /etc/systemd/logind.conf.d/50-override.conf
Brian Stinson 2593d8
 ... some administrator override
Brian Stinson 2593d8
-      </programlisting>
Brian Stinson 2593d8
-    </example>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze unit-paths</command> outputs a list of all
Brian Stinson 2593d8
-    directories from which unit files, <filename>.d</filename> overrides, and
Brian Stinson 2593d8
-    <filename>.wants</filename>, <filename>.requires</filename> symlinks may be
Brian Stinson 2593d8
-    loaded. Combine with <option>--user</option> to retrieve the list for the user
Brian Stinson 2593d8
-    manager instance, and <option>--global</option> for the global configuration of
Brian Stinson 2593d8
-    user manager instances. Note that this verb prints the list that is compiled into
Brian Stinson 2593d8
-    <command>systemd-analyze</command> itself, and does not comunicate with the
Brian Stinson 2593d8
-    running manager. Use
Brian Stinson 2593d8
-    <programlisting>systemctl [--user] [--global] show -p UnitPath --value</programlisting>
Brian Stinson 2593d8
-    to retrieve the actual list that the manager uses, with any empty directories
Brian Stinson 2593d8
-    omitted.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze log-level</command>
Brian Stinson 2593d8
-    prints the current log level of the <command>systemd</command> daemon.
Brian Stinson 2593d8
-    If an optional argument <replaceable>LEVEL</replaceable> is provided, then the command changes the current log
Brian Stinson 2593d8
-    level of the <command>systemd</command> daemon to <replaceable>LEVEL</replaceable> (accepts the same values as
Brian Stinson 2593d8
-    <option>--log-level=</option> described in
Brian Stinson 2593d8
-    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze log-target</command>
Brian Stinson 2593d8
-    prints the current log target of the <command>systemd</command> daemon.
Brian Stinson 2593d8
-    If an optional argument <replaceable>TARGET</replaceable> is provided, then the command changes the current log
Brian Stinson 2593d8
-    target of the <command>systemd</command> daemon to <replaceable>TARGET</replaceable> (accepts the same values as
Brian Stinson 2593d8
-    <option>--log-target=</option>, described in
Brian Stinson 2593d8
-    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze syscall-filter <optional><replaceable>SET</replaceable>…</optional></command>
Brian Stinson 2593d8
-    will list system calls contained in the specified system call set <replaceable>SET</replaceable>,
Brian Stinson 2593d8
-    or all known sets if no sets are specified. Argument <replaceable>SET</replaceable> must include
Brian Stinson 2593d8
-    the <literal>@</literal> prefix.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze verify</command> will load unit files and print
Brian Stinson 2593d8
-    warnings if any errors are detected. Files specified on the command line will be
Brian Stinson 2593d8
-    loaded, but also any other units referenced by them. The full unit search path is
Brian Stinson 2593d8
-    formed by combining the directories for all command line arguments, and the usual unit
Brian Stinson 2593d8
-    load paths (variable <varname>$SYSTEMD_UNIT_PATH</varname> is supported, and may be
Brian Stinson 2593d8
-    used to replace or augment the compiled in set of unit load paths; see
Brian Stinson 2593d8
-    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
Brian Stinson 2593d8
-    All units files present in the directories containing the command line arguments will
Brian Stinson 2593d8
-    be used in preference to the other paths.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze calendar</command> will parse and normalize repetitive calendar time events, and
Brian Stinson 2593d8
-    will calculate when they will elapse next. This takes the same input as the <varname>OnCalendar=</varname> setting
Brian Stinson 2593d8
-    in <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>, following the
Brian Stinson 2593d8
-    syntax described in
Brian Stinson 2593d8
-    <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze service-watchdogs</command>
Brian Stinson 2593d8
-    prints the current state of service runtime watchdogs of the <command>systemd</command> daemon.
Brian Stinson 2593d8
-    If an optional boolean argument is provided, then globally enables or disables the service
Brian Stinson 2593d8
-    runtime watchdogs (<option>WatchdogSec=</option>) and emergency actions (e.g.
Brian Stinson 2593d8
-    <option>OnFailure=</option> or <option>StartLimitAction=</option>); see
Brian Stinson 2593d8
-    <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
Brian Stinson 2593d8
-    The hardware watchdog is not affected by this setting.</para>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para><command>systemd-analyze security</command> analyzes the security and sandboxing settings of one or more
Brian Stinson 2593d8
-    specified service units. If at least one unit name is specified the security settings of the specified service
Brian Stinson 2593d8
-    units are inspected and a detailed analysis is shown. If no unit name is specified, all currently loaded,
Brian Stinson 2593d8
-    long-running service units are inspected and a terse table with results shown. The command checks for various
Brian Stinson 2593d8
-    security-related service settings, assigning each a numeric "exposure level" value, depending on how important a
Brian Stinson 2593d8
-    setting is. It then calculates an overall exposure level for the whole unit, which is an estimation in the range
Brian Stinson 2593d8
-    0.0…10.0 indicating how exposed a service is security-wise. High exposure levels indicate very little applied
Brian Stinson 2593d8
-    sandboxing. Low exposure levels indicate tight sandboxing and strongest security restrictions. Note that this only
Brian Stinson 2593d8
-    analyzes the per-service security features systemd itself implements. This means that any additional security
Brian Stinson 2593d8
-    mechanisms applied by the service code itself are not accounted for. The exposure level determined this way should
Brian Stinson 2593d8
-    not be misunderstood: a high exposure level neither means that there is no effective sandboxing applied by the
Brian Stinson 2593d8
-    service code itself, nor that the service is actually vulnerable to remote or local attacks. High exposure levels
Brian Stinson 2593d8
-    do indicate however that most likely the service might benefit from additional settings applied to them. Please
Brian Stinson 2593d8
-    note that many of the security and sandboxing settings individually can be circumvented — unless combined with
Brian Stinson 2593d8
-    others. For example, if a service retains the privilege to establish or undo mount points many of the sandboxing
Brian Stinson 2593d8
-    options can be undone by the service code itself. Due to that is essential that each service uses the most
Brian Stinson 2593d8
-    comprehensive and strict sandboxing and security settings possible. The tool will take into account some of these
Brian Stinson 2593d8
-    combinations and relationships between the settings, but not all. Also note that the security and sandboxing
Brian Stinson 2593d8
-    settings analyzed here only apply to the operations executed by the service code itself. If a service has access to
Brian Stinson 2593d8
-    an IPC system (such as D-Bus) it might request operations from other services that are not subject to the same
Brian Stinson 2593d8
-    restrictions. Any comprehensive security and sandboxing analysis is hence incomplete if the IPC access policy is
Brian Stinson 2593d8
-    not validated too.</para>
Brian Stinson 2593d8
+        </programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-    <para>If no command is passed, <command>systemd-analyze
Brian Stinson 2593d8
-    time</command> is implied.</para>
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze verify <replaceable>FILE</replaceable>...</command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command will load unit files and print warnings if any errors are detected. Files specified
Brian Stinson 2593d8
+      on the command line will be loaded, but also any other units referenced by them. The full unit search
Brian Stinson 2593d8
+      path is formed by combining the directories for all command line arguments, and the usual unit load
Brian Stinson 2593d8
+      paths (variable <varname>$SYSTEMD_UNIT_PATH</varname> is supported, and may be used to replace or
Brian Stinson 2593d8
+      augment the compiled in set of unit load paths; see
Brian Stinson 2593d8
+      <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>).  All
Brian Stinson 2593d8
+      units files present in the directories containing the command line arguments will be used in preference
Brian Stinson 2593d8
+      to the other paths.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>The following errors are currently detected:</para>
Brian Stinson 2593d8
+      <itemizedlist>
Brian Stinson 2593d8
+        <listitem><para>unknown sections and directives,</para></listitem>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <listitem><para>missing dependencies which are required to start the given unit,</para></listitem>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <listitem><para>man pages listed in <varname>Documentation=</varname> which are not found in the
Brian Stinson 2593d8
+        system,</para></listitem>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <listitem><para>commands listed in <varname>ExecStart=</varname> and similar which are not found in
Brian Stinson 2593d8
+        the system or not executable.</para></listitem>
Brian Stinson 2593d8
+      </itemizedlist>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Misspelt directives</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ cat ./user.slice
Brian Stinson 2593d8
+[Unit]
Brian Stinson 2593d8
+WhatIsThis=11
Brian Stinson 2593d8
+Documentation=man:nosuchfile(1)
Brian Stinson 2593d8
+Requires=different.service
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+[Service]
Brian Stinson 2593d8
+Description=x
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+$ systemd-analyze verify ./user.slice
Brian Stinson 2593d8
+[./user.slice:9] Unknown lvalue 'WhatIsThis' in section 'Unit'
Brian Stinson 2593d8
+[./user.slice:13] Unknown section 'Service'. Ignoring.
Brian Stinson 2593d8
+Error: org.freedesktop.systemd1.LoadFailed:
Brian Stinson 2593d8
+   Unit different.service failed to load:
Brian Stinson 2593d8
+   No such file or directory.
Brian Stinson 2593d8
+Failed to create user.slice/start: Invalid argument
Brian Stinson 2593d8
+user.slice: man nosuchfile(1) command failed with code 16
Brian Stinson 2593d8
+        </programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+        <title>Missing service units</title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        <programlisting>$ tail ./a.socket ./b.socket
Brian Stinson 2593d8
+==> ./a.socket <==
Brian Stinson 2593d8
+[Socket]
Brian Stinson 2593d8
+ListenStream=100
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+==> ./b.socket <==
Brian Stinson 2593d8
+[Socket]
Brian Stinson 2593d8
+ListenStream=100
Brian Stinson 2593d8
+Accept=yes
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+$ systemd-analyze verify ./a.socket ./b.socket
Brian Stinson 2593d8
+Service a.service not loaded, a.socket cannot be started.
Brian Stinson 2593d8
+Service b@0.service not loaded, b.socket cannot be started.
Brian Stinson 2593d8
+        </programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+    <refsect2>
Brian Stinson 2593d8
+      <title><command>systemd-analyze security <optional><replaceable>UNIT</replaceable>...</optional></command></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>This command analyzes the security and sandboxing settings of one or more specified service
Brian Stinson 2593d8
+      units. If at least one unit name is specified the security settings of the specified service units are
Brian Stinson 2593d8
+      inspected and a detailed analysis is shown. If no unit name is specified, all currently loaded,
Brian Stinson 2593d8
+      long-running service units are inspected and a terse table with results shown. The command checks for
Brian Stinson 2593d8
+      various security-related service settings, assigning each a numeric "exposure level" value, depending
Brian Stinson 2593d8
+      on how important a setting is. It then calculates an overall exposure level for the whole unit, which
Brian Stinson 2593d8
+      is an estimation in the range 0.0…10.0 indicating how exposed a service is security-wise. High exposure
Brian Stinson 2593d8
+      levels indicate very little applied sandboxing. Low exposure levels indicate tight sandboxing and
Brian Stinson 2593d8
+      strongest security restrictions. Note that this only analyzes the per-service security features systemd
Brian Stinson 2593d8
+      itself implements. This means that any additional security mechanisms applied by the service code
Brian Stinson 2593d8
+      itself are not accounted for. The exposure level determined this way should not be misunderstood: a
Brian Stinson 2593d8
+      high exposure level neither means that there is no effective sandboxing applied by the service code
Brian Stinson 2593d8
+      itself, nor that the service is actually vulnerable to remote or local attacks. High exposure levels do
Brian Stinson 2593d8
+      indicate however that most likely the service might benefit from additional settings applied to
Brian Stinson 2593d8
+      them.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <para>Please note that many of the security and sandboxing settings individually can be circumvented —
Brian Stinson 2593d8
+      unless combined with others. For example, if a service retains the privilege to establish or undo mount
Brian Stinson 2593d8
+      points many of the sandboxing options can be undone by the service code itself. Due to that is
Brian Stinson 2593d8
+      essential that each service uses the most comprehensive and strict sandboxing and security settings
Brian Stinson 2593d8
+      possible. The tool will take into account some of these combinations and relationships between the
Brian Stinson 2593d8
+      settings, but not all. Also note that the security and sandboxing settings analyzed here only apply to
Brian Stinson 2593d8
+      the operations executed by the service code itself. If a service has access to an IPC system (such as
Brian Stinson 2593d8
+      D-Bus) it might request operations from other services that are not subject to the same
Brian Stinson 2593d8
+      restrictions. Any comprehensive security and sandboxing analysis is hence incomplete if the IPC access
Brian Stinson 2593d8
+      policy is not validated too.</para>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <example>
Brian Stinson 2593d8
+      <title>Analyze <filename noindex="true">systemd-logind.service</filename></title>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+      <programlisting>$ systemd-analyze security --no-pager systemd-logind.service
Brian Stinson 2593d8
+  NAME                DESCRIPTION                              EXPOSURE
Brian Stinson 2593d8
+✗ PrivateNetwork=     Service has access to the host's network      0.5
Brian Stinson 2593d8
+✗ User=/DynamicUser=  Service runs as root user                     0.4
Brian Stinson 2593d8
+✗ DeviceAllow=        Service has no device ACL                     0.2
Brian Stinson 2593d8
+✓ IPAddressDeny=      Service blocks all IP address ranges
Brian Stinson 2593d8
+...
Brian Stinson 2593d8
+→ Overall exposure level for systemd-logind.service: 4.1 OK 🙂
Brian Stinson 2593d8
+</programlisting>
Brian Stinson 2593d8
+      </example>
Brian Stinson 2593d8
+    </refsect2>
Brian Stinson 2593d8
   </refsect1>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
   <refsect1>
Brian Stinson 2593d8
@@ -408,88 +670,6 @@ NAutoVTs=8
Brian Stinson 2593d8
     otherwise.</para>
Brian Stinson 2593d8
   </refsect1>
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-  <refsect1>
Brian Stinson 2593d8
-    <title>Examples for <command>dot</command></title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <example>
Brian Stinson 2593d8
-      <title>Plots all dependencies of any unit whose name starts with
Brian Stinson 2593d8
-      <literal>avahi-daemon</literal></title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <programlisting>$ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg > avahi.svg
Brian Stinson 2593d8
-$ eog avahi.svg</programlisting>
Brian Stinson 2593d8
-    </example>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <example>
Brian Stinson 2593d8
-      <title>Plots the dependencies between all known target units</title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <programlisting>$ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' | dot -Tsvg > targets.svg
Brian Stinson 2593d8
-$ eog targets.svg</programlisting>
Brian Stinson 2593d8
-    </example>
Brian Stinson 2593d8
-  </refsect1>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-  <refsect1>
Brian Stinson 2593d8
-    <title>Examples for <command>verify</command></title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <para>The following errors are currently detected:</para>
Brian Stinson 2593d8
-    <itemizedlist>
Brian Stinson 2593d8
-      <listitem><para>unknown sections and directives,
Brian Stinson 2593d8
-      </para></listitem>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <listitem><para>missing dependencies which are required to start
Brian Stinson 2593d8
-      the given unit,</para></listitem>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <listitem><para>man pages listed in
Brian Stinson 2593d8
-      <varname>Documentation=</varname> which are not found in the
Brian Stinson 2593d8
-      system,</para></listitem>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <listitem><para>commands listed in <varname>ExecStart=</varname>
Brian Stinson 2593d8
-      and similar which are not found in the system or not
Brian Stinson 2593d8
-      executable.</para></listitem>
Brian Stinson 2593d8
-    </itemizedlist>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <example>
Brian Stinson 2593d8
-      <title>Misspelt directives</title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <programlisting>$ cat ./user.slice
Brian Stinson 2593d8
-[Unit]
Brian Stinson 2593d8
-WhatIsThis=11
Brian Stinson 2593d8
-Documentation=man:nosuchfile(1)
Brian Stinson 2593d8
-Requires=different.service
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-[Service]
Brian Stinson 2593d8
-Description=x
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-$ systemd-analyze verify ./user.slice
Brian Stinson 2593d8
-[./user.slice:9] Unknown lvalue 'WhatIsThis' in section 'Unit'
Brian Stinson 2593d8
-[./user.slice:13] Unknown section 'Service'. Ignoring.
Brian Stinson 2593d8
-Error: org.freedesktop.systemd1.LoadFailed:
Brian Stinson 2593d8
-   Unit different.service failed to load:
Brian Stinson 2593d8
-   No such file or directory.
Brian Stinson 2593d8
-Failed to create user.slice/start: Invalid argument
Brian Stinson 2593d8
-user.slice: man nosuchfile(1) command failed with code 16
Brian Stinson 2593d8
-      </programlisting>
Brian Stinson 2593d8
-    </example>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-    <example>
Brian Stinson 2593d8
-      <title>Missing service units</title>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-      <programlisting>$ tail ./a.socket ./b.socket
Brian Stinson 2593d8
-==> ./a.socket <==
Brian Stinson 2593d8
-[Socket]
Brian Stinson 2593d8
-ListenStream=100
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-==> ./b.socket <==
Brian Stinson 2593d8
-[Socket]
Brian Stinson 2593d8
-ListenStream=100
Brian Stinson 2593d8
-Accept=yes
Brian Stinson 2593d8
-
Brian Stinson 2593d8
-$ systemd-analyze verify ./a.socket ./b.socket
Brian Stinson 2593d8
-Service a.service not loaded, a.socket cannot be started.
Brian Stinson 2593d8
-Service b@0.service not loaded, b.socket cannot be started.
Brian Stinson 2593d8
-      </programlisting>
Brian Stinson 2593d8
-    </example>
Brian Stinson 2593d8
-  </refsect1>
Brian Stinson 2593d8
-
Brian Stinson 2593d8
   <xi:include href="less-variables.xml" />
Brian Stinson 2593d8
 
Brian Stinson 2593d8
   <refsect1>