Systemd deep introspection pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install systemd-deep --hash sha256:c673ebb4e9e485adf174f2008150d686d9b41b726393a038110a94a54651e0be

• systemd.analyze_blame exec low

  systemd-analyze blame

  Show the top 30 units sorted by how long they took to start. Use to find a slow boot.

  View source on GitHub
• systemd.analyze_critical_chain exec low

  systemd-analyze critical-chain

  Shows the boot-time critical path leading to one unit — useful for understanding "why did multi-user.target take so long?"

  View source on GitHub
• systemd.analyze_security exec low

  systemd-analyze security

  Scores one unit by its sandboxing posture — NoNewPrivileges, ProtectSystem, CapabilityBoundingSet, etc. Use to audit "how locked down is this service?"

  View source on GitHub
• systemd.boot_errors exec low

  Boot-time journal errors

  `journalctl -b -p err` — every error-priority log line from the current boot. Use to triage a "is everything healthy?" check.

  View source on GitHub
• systemd.cgroup_top exec low

  systemd-cgtop (3 samples)

  Show three batched cgtop samples — CPU + memory + IO + tasks per cgroup. The systemd-aware top equivalent.

  View source on GitHub
• systemd.cgroup_tree exec low

  systemd cgroup tree

  `systemd-cgls` — the full cgroup hierarchy with process names. Use to understand resource accounting.

  View source on GitHub
• systemd.daemon_reload exec medium

  systemctl daemon-reload

  Re-read unit files from disk. Required after editing a unit file or installing a new package. Without this, systemctl restart still uses the old unit definition.

  View source on GitHub
• systemd.failed_units exec low

  Failed systemd units

  `systemctl --failed` — every unit not in `active` state with its last failure reason. The fast "what is broken on this host?" check.

  View source on GitHub
• systemd.journal_disk_usage exec low

  journalctl --disk-usage

  Show how much disk the systemd journal is using.

  View source on GitHub
• systemd.list_unit_files exec low

  List installed unit files

  `systemctl list-unit-files --type=service` — every service file on disk with its enabled/disabled state.

  View source on GitHub
• systemd.list_units exec low

  List all systemd units

  `systemctl list-units --type=service --all` — every service known to systemd, active or inactive.

  View source on GitHub
• systemd.reset_failed exec medium

  systemctl reset-failed [unit]

  Clear the "failed" state from units that crashed. Required before start-limit thresholds reset and the unit can be auto-restarted. Without a unit name, resets every failed unit.

  View source on GitHub
• systemd.sockets exec low

  systemd-managed sockets

  `systemctl list-sockets` — every socket-activated unit with its listening address.

  View source on GitHub
• systemd.timers exec low

  Active systemd timers

  `systemctl list-timers` — every timer with its next-elapse and last-trigger. The systemd replacement for crontab.

  View source on GitHub
• systemd.unit_kill exec high

  systemctl kill -s <signal> <unit>

  Send a signal to a unit's main process (or all processes). Useful when a service is wedged and SIGTERM-via-stop isn't working. SIGKILL is unrecoverable mid-syscall; consider SIGTERM/SIGHUP first.

  View source on GitHub
• systemd.unit_mask exec high

  systemctl mask <unit>

  Prevent a unit from being started, even by dependencies. Symlinks the unit to /dev/null. Used to disable a unit that another package keeps re-enabling. Reversible with unmask.

  View source on GitHub
• systemd.unit_reload exec high

  systemctl reload <unit>

  Ask one unit to reload its config without restarting. Only works if the unit has ExecReload= defined. Use over `restart` whenever possible — no downtime.

  View source on GitHub
• systemd.unit_restart exec high

  systemctl restart <unit>

  Stop then start one unit. The service is unavailable during the gap (typically <1s for healthy services, much longer if it has a long shutdown). Workload-bearing units mean a real outage — prefer reload when supported.

  View source on GitHub
• systemd.unit_show exec low

  systemctl show <unit>

  Show the full property dump for one unit — every directive (CPUShares, MemoryMax, Restart, ExecStart, etc). This surfaces the unit's `Environment=` values and full ExecStart command line, which commonly carry injected secrets (DB URLs, API keys, tokens). The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

  View source on GitHub
• systemd.unit_start exec medium

  systemctl start <unit>

  Start one unit. If already running, no-op. Use after a stop or reset_failed to bring a service back.

  View source on GitHub
• systemd.unit_stop exec high

  systemctl stop <unit>

  Stop one unit. Workload-bearing units stay down until manually started or auto-restarted by `Restart=`. Use during incident containment or planned downtime.

  View source on GitHub
• systemd.unit_unmask exec medium

  systemctl unmask <unit>

  Undo `mask` for one unit. The unit can be started again.

  View source on GitHub
• systemd.vacuum_journal exec high

  Vacuum the systemd journal

  Drops journal records older than the cutoff time. Frees disk but loses forensic history. Provide cutoff as a journalctl --vacuum-time value (e.g. "7d", "30d").

  View source on GitHub
• systemd.watchdog_status exec low

  Watchdog status across units

  Lists every unit with a non-zero WatchdogUSec property — services that have systemd-level watchdog supervision.

  View source on GitHub