Systemd deep introspection pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install systemd-deep --hash sha256:56db8a65d2391103b8c00bb2160c50cceeb24a7e5e210c7767ffec6d0c147dee

Setup

Operates on the local runner host — no credentials needed.

sudo usermod -aG systemd-journal emisar
sudo systemctl restart emisar

id -nG emisar | tr ' ' '\n' | grep -Fx systemd-journal
sudo -u emisar journalctl -b -n 1 --no-pager >/dev/null

sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-systemd-deep-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar

test "$(systemctl show emisar --property=User --value)" = root

sudo emisar pack verify systemd-deep

Install and configure a pack walks through the whole sequence on a host.

• systemd.analyze_blame exec low Low — read-only or trivially reversible

  systemd-analyze blame

  Show the top 30 units sorted by how long they took to start. Use to find a slow boot.

  View source on GitHub
• systemd.analyze_critical_chain exec low Low — read-only or trivially reversible

  systemd-analyze critical-chain

  Show the boot-time critical path leading to one unit — useful for understanding "why did multi-user.target take so long?"

  View source on GitHub
• systemd.analyze_security exec low Low — read-only or trivially reversible

  systemd-analyze security

  Check the sandboxing posture of one unit — NoNewPrivileges, ProtectSystem, CapabilityBoundingSet, etc. Use to audit "how locked down is this service?"

  View source on GitHub
• systemd.boot_errors exec medium Medium — changes state, easily reversible

  Boot-time journal errors

  `journalctl -b -p err` — the most recent 100 error-priority log lines from the current boot. Use to triage an "is everything healthy?" check.

  View source on GitHub
• systemd.cgroup_top exec low Low — read-only or trivially reversible

  systemd-cgtop (3 samples)

  Show three batched cgtop samples — CPU + memory + IO + tasks per cgroup. The systemd-aware top equivalent.

  View source on GitHub
• systemd.cgroup_tree exec low Low — read-only or trivially reversible

  systemd cgroup tree

  `systemd-cgls` — the full cgroup hierarchy with process names. Use to understand resource accounting.

  View source on GitHub
• systemd.daemon_reload exec medium Medium — changes state, easily reversible

  systemctl daemon-reload

  Re-read unit files from disk. Required after editing a unit file or installing a new package. Without this, systemctl restart still uses the old unit definition.

  View source on GitHub
• systemd.failed_units exec low Low — read-only or trivially reversible

  Failed systemd units

  `systemctl --failed` — every unit not in `active` state with its last failure reason. The fast "what is broken on this host?" check.

  View source on GitHub
• systemd.journal_disk_usage exec low Low — read-only or trivially reversible

  journalctl --disk-usage

  Show how much disk the systemd journal is using.

  View source on GitHub
• systemd.list_unit_files exec low Low — read-only or trivially reversible

  List installed unit files

  `systemctl list-unit-files --type=service` — every service file on disk with its enabled/disabled state.

  View source on GitHub
• systemd.list_units exec low Low — read-only or trivially reversible

  List all systemd units

  `systemctl list-units --type=service --all` — every service known to systemd, active or inactive.

  View source on GitHub
• systemd.reset_failed exec medium Medium — changes state, easily reversible

  systemctl reset-failed [unit]

  Clear the "failed" state from units that crashed. Required before start-limit thresholds reset and the unit can be auto-restarted. Without a unit name, resets every failed unit.

  View source on GitHub
• systemd.sockets exec low Low — read-only or trivially reversible

  systemd-managed sockets

  `systemctl list-sockets` — every socket-activated unit with its listening address.

  View source on GitHub
• systemd.timers exec low Low — read-only or trivially reversible

  Active systemd timers

  `systemctl list-timers` — every timer with its next-elapse and last-trigger. The systemd replacement for crontab.

  View source on GitHub
• systemd.unit_kill exec high High — service-affecting

  systemctl kill -s <signal> <unit>

  Send a signal to a unit's main process (or all processes). Useful when a service is wedged and SIGTERM-via-stop isn't working. SIGKILL is unrecoverable mid-syscall; consider SIGTERM/SIGHUP first.

  View source on GitHub
• systemd.unit_mask exec high High — service-affecting

  systemctl mask <unit>

  Prevent a unit from being started, even by dependencies. Symlinks the unit to /dev/null. Used to disable a unit that another package keeps re-enabling. Reversible with unmask.

  View source on GitHub
• systemd.unit_show exec high High — service-affecting

  systemctl show <unit>

  Show the full property dump for one unit — every directive (CPUShares, MemoryMax, Restart, ExecStart, etc). This surfaces the unit's `Environment=` values and full ExecStart command line, which commonly carry injected secrets (DB URLs, API keys, tokens). The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

  View source on GitHub
• systemd.unit_unmask exec medium Medium — changes state, easily reversible

  systemctl unmask <unit>

  Undo `mask` for one unit. The unit can be started again.

  View source on GitHub
• systemd.vacuum_journal exec high High — service-affecting

  Vacuum the systemd journal

  Drop journal records older than the cutoff time. Frees disk but loses forensic history. Provide cutoff as a journalctl --vacuum-time value (e.g. "7d", "30d").

  View source on GitHub
• systemd.watchdog_status exec low Low — read-only or trivially reversible

  Watchdog status across units

  List every unit with a non-zero WatchdogUSec property — services that have systemd-level watchdog supervision.

  View source on GitHub