man/systemd-analyze.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   5
   6 <refentry id="systemd-analyze" conditional='ENABLE_ANALYZE'
   7     xmlns:xi="http://www.w3.org/2001/XInclude">
   8
   9   <refentryinfo>
  10     <title>systemd-analyze</title>
  11     <productname>systemd</productname>
  12   </refentryinfo>
  13
  14   <refmeta>
  15     <refentrytitle>systemd-analyze</refentrytitle>
  16     <manvolnum>1</manvolnum>
  17   </refmeta>
  18
  19   <refnamediv>
  20     <refname>systemd-analyze</refname>
  21     <refpurpose>Analyze and debug system manager</refpurpose>
  22   </refnamediv>
  23
  24   <refsynopsisdiv>
  25     <cmdsynopsis>
  26       <command>systemd-analyze</command>
  27       <arg choice="opt" rep="repeat">OPTIONS</arg>
  28       <arg>time</arg>
  29     </cmdsynopsis>
  30     <cmdsynopsis>
  31       <command>systemd-analyze</command>
  32       <arg choice="opt" rep="repeat">OPTIONS</arg>
  33       <arg choice="plain">blame</arg>
  34     </cmdsynopsis>
  35     <cmdsynopsis>
  36       <command>systemd-analyze</command>
  37       <arg choice="opt" rep="repeat">OPTIONS</arg>
  38       <arg choice="plain">critical-chain</arg>
  39       <arg choice="opt" rep="repeat"><replaceable>UNIT</replaceable></arg>
  40     </cmdsynopsis>
  41
  42     <cmdsynopsis>
  43       <command>systemd-analyze</command>
  44       <arg choice="opt" rep="repeat">OPTIONS</arg>
  45       <arg choice="plain">dump</arg>
  46     </cmdsynopsis>
  47
  48     <cmdsynopsis>
  49       <command>systemd-analyze</command>
  50       <arg choice="opt" rep="repeat">OPTIONS</arg>
  51       <arg choice="plain">plot</arg>
  52       <arg choice="opt">>file.svg</arg>
  53     </cmdsynopsis>
  54     <cmdsynopsis>
  55       <command>systemd-analyze</command>
  56       <arg choice="opt" rep="repeat">OPTIONS</arg>
  57       <arg choice="plain">dot</arg>
  58       <arg choice="opt" rep="repeat"><replaceable>PATTERN</replaceable></arg>
  59       <arg choice="opt">>file.dot</arg>
  60     </cmdsynopsis>
  61
  62     <cmdsynopsis>
  63       <command>systemd-analyze</command>
  64       <arg choice="opt" rep="repeat">OPTIONS</arg>
  65       <arg choice="plain">unit-paths</arg>
  66     </cmdsynopsis>
  67     <cmdsynopsis>
  68       <command>systemd-analyze</command>
  69       <arg choice="opt" rep="repeat">OPTIONS</arg>
  70       <arg choice="plain">exit-status</arg>
  71       <arg choice="opt" rep="repeat"><replaceable>STATUS</replaceable></arg>
  72     </cmdsynopsis>
  73     <cmdsynopsis>
  74       <command>systemd-analyze</command>
  75       <arg choice="opt" rep="repeat">OPTIONS</arg>
  76       <arg choice="plain">capability</arg>
  77       <arg choice="opt" rep="repeat"><replaceable>CAPABILITY</replaceable></arg>
  78     </cmdsynopsis>
  79     <cmdsynopsis>
  80       <command>systemd-analyze</command>
  81       <arg choice="opt" rep="repeat">OPTIONS</arg>
  82       <arg choice="plain">condition</arg>
  83       <arg choice="plain"><replaceable>CONDITION</replaceable>…</arg>
  84     </cmdsynopsis>
  85     <cmdsynopsis>
  86       <command>systemd-analyze</command>
  87       <arg choice="opt" rep="repeat">OPTIONS</arg>
  88       <arg choice="plain">syscall-filter</arg>
  89       <arg choice="opt"><replaceable>SET</replaceable>…</arg>
  90     </cmdsynopsis>
  91     <cmdsynopsis>
  92       <command>systemd-analyze</command>
  93       <arg choice="opt" rep="repeat">OPTIONS</arg>
  94       <arg choice="plain">calendar</arg>
  95       <arg choice="plain" rep="repeat"><replaceable>SPEC</replaceable></arg>
  96     </cmdsynopsis>
  97     <cmdsynopsis>
  98       <command>systemd-analyze</command>
  99       <arg choice="opt" rep="repeat">OPTIONS</arg>
 100       <arg choice="plain">timestamp</arg>
 101       <arg choice="plain" rep="repeat"><replaceable>TIMESTAMP</replaceable></arg>
 102     </cmdsynopsis>
 103     <cmdsynopsis>
 104       <command>systemd-analyze</command>
 105       <arg choice="opt" rep="repeat">OPTIONS</arg>
 106       <arg choice="plain">timespan</arg>
 107       <arg choice="plain" rep="repeat"><replaceable>SPAN</replaceable></arg>
 108     </cmdsynopsis>
 109     <cmdsynopsis>
 110       <command>systemd-analyze</command>
 111       <arg choice="opt" rep="repeat">OPTIONS</arg>
 112       <arg choice="plain">cat-config</arg>
 113       <arg choice="plain" rep="repeat"><replaceable>NAME</replaceable>|<replaceable>PATH</replaceable></arg>
 114     </cmdsynopsis>
 115     <cmdsynopsis>
 116       <command>systemd-analyze</command>
 117       <arg choice="opt" rep="repeat">OPTIONS</arg>
 118       <arg choice="plain">verify</arg>
 119       <arg choice="opt" rep="repeat"><replaceable>FILE</replaceable></arg>
 120     </cmdsynopsis>
 121     <cmdsynopsis>
 122       <command>systemd-analyze</command>
 123       <arg choice="opt" rep="repeat">OPTIONS</arg>
 124       <arg choice="plain">security</arg>
 125       <arg choice="plain" rep="repeat"><replaceable>UNIT</replaceable></arg>
 126     </cmdsynopsis>
 127   </refsynopsisdiv>
 128
 129   <refsect1>
 130     <title>Description</title>
 131
 132     <para><command>systemd-analyze</command> may be used to determine
 133     system boot-up performance statistics and retrieve other state and
 134     tracing information from the system and service manager, and to
 135     verify the correctness of unit files. It is also used to access
 136     special functions useful for advanced system manager debugging.</para>
 137
 138     <para>If no command is passed, <command>systemd-analyze
 139     time</command> is implied.</para>
 140
 141     <refsect2>
 142       <title><command>systemd-analyze time</command></title>
 143
 144       <para>This command prints the time spent in the kernel before userspace has been reached, the time
 145       spent in the initial RAM disk (initrd) before normal system userspace has been reached, and the time
 146       normal system userspace took to initialize. Note that these measurements simply measure the time passed
 147       up to the point where all system services have been spawned, but not necessarily until they fully
 148       finished initialization or the disk is idle.</para>
 149
 150       <example>
 151         <title><command>Show how long the boot took</command></title>
 152
 153         <programlisting># in a container
 154 $ systemd-analyze time
 155 Startup finished in 296ms (userspace)
 156 multi-user.target reached after 275ms in userspace
 157
 158 # on a real machine
 159 $ systemd-analyze time
 160 Startup finished in 2.584s (kernel) + 19.176s (initrd) + 47.847s (userspace) = 1min 9.608s
 161 multi-user.target reached after 47.820s in userspace
 162 </programlisting>
 163       </example>
 164     </refsect2>
 165
 166     <refsect2>
 167       <title><command>systemd-analyze blame</command></title>
 168
 169       <para>This command prints a list of all running units, ordered by the time they took to initialize.
 170       This information may be used to optimize boot-up times. Note that the output might be misleading as the
 171       initialization of one service might be slow simply because it waits for the initialization of another
 172       service to complete.  Also note: <command>systemd-analyze blame</command> doesn't display results for
 173       services with <varname>Type=simple</varname>, because systemd considers such services to be started
 174       immediately, hence no measurement of the initialization delays can be done. Also note that this command
 175       only shows the time units took for starting up, it does not show how long unit jobs spent in the
 176       execution queue. In particular it shows the time units spent in <literal>activating</literal> state,
 177       which is not defined for units such as device units that transition directly from
 178       <literal>inactive</literal> to <literal>active</literal>. This command hence gives an impression of the
 179       performance of program code, but cannot accurately reflect latency introduced by waiting for
 180       hardware and similar events.</para>
 181
 182       <example>
 183         <title><command>Show which units took the most time during boot</command></title>
 184
 185         <programlisting>$ systemd-analyze blame
 186          32.875s pmlogger.service
 187          20.905s systemd-networkd-wait-online.service
 188          13.299s dev-vda1.device
 189          ...
 190             23ms sysroot.mount
 191             11ms initrd-udevadm-cleanup-db.service
 192              3ms sys-kernel-config.mount
 193         </programlisting>
 194       </example>
 195     </refsect2>
 196
 197     <refsect2>
 198       <title><command>systemd-analyze critical-chain <optional><replaceable>UNIT</replaceable>...</optional></command></title>
 199
 200       <para>This command prints a tree of the time-critical chain of units (for each of the specified
 201       <replaceable>UNIT</replaceable>s or for the default target otherwise). The time after the unit is
 202       active or started is printed after the "@" character. The time the unit takes to start is printed after
 203       the "+" character. Note that the output might be misleading as the initialization of services might
 204       depend on socket activation and because of the parallel execution of units. Also, similar to the
 205       <command>blame</command> command, this only takes into account the time units spent in
 206       <literal>activating</literal> state, and hence does not cover units that never went through an
 207       <literal>activating</literal> state (such as device units that transition directly from
 208       <literal>inactive</literal> to <literal>active</literal>). Moreover it does not show information on
 209       jobs (and in particular not jobs that timed out).</para>
 210
 211       <example>
 212         <title><command>systemd-analyze critical-chain</command></title>
 213
 214       <programlisting>$ systemd-analyze critical-chain
 215 multi-user.target @47.820s
 216 └─pmie.service @35.968s +548ms
 217   └─pmcd.service @33.715s +2.247s
 218     └─network-online.target @33.712s
 219       └─systemd-networkd-wait-online.service @12.804s +20.905s
 220         └─systemd-networkd.service @11.109s +1.690s
 221           └─systemd-udevd.service @9.201s +1.904s
 222             └─systemd-tmpfiles-setup-dev.service @7.306s +1.776s
 223               └─kmod-static-nodes.service @6.976s +177ms
 224                 └─systemd-journald.socket
 225                   └─system.slice
 226                     └─-.slice
 227 </programlisting>
 228       </example>
 229     </refsect2>
 230
 231     <refsect2>
 232       <title><command>systemd-analyze dump</command></title>
 233
 234       <para>This command outputs a (usually very long) human-readable serialization of the complete server
 235       state. Its format is subject to change without notice and should not be parsed by applications.</para>
 236
 237       <example>
 238         <title>Show the internal state of user manager</title>
 239
 240         <programlisting>$ systemd-analyze --user dump
 241 Timestamp userspace: Thu 2019-03-14 23:28:07 CET
 242 Timestamp finish: Thu 2019-03-14 23:28:07 CET
 243 Timestamp generators-start: Thu 2019-03-14 23:28:07 CET
 244 Timestamp generators-finish: Thu 2019-03-14 23:28:07 CET
 245 Timestamp units-load-start: Thu 2019-03-14 23:28:07 CET
 246 Timestamp units-load-finish: Thu 2019-03-14 23:28:07 CET
 247 -> Unit proc-timer_list.mount:
 248         Description: /proc/timer_list
 249         ...
 250 -> Unit default.target:
 251         Description: Main user target
 252 ...
 253 </programlisting>
 254       </example>
 255     </refsect2>
 256
 257     <refsect2>
 258       <title><command>systemd-analyze plot</command></title>
 259
 260       <para>This command prints an SVG graphic detailing which system services have been started at what
 261       time, highlighting the time they spent on initialization.</para>
 262
 263       <example>
 264         <title><command>Plot a bootchart</command></title>
 265
 266         <programlisting>$ systemd-analyze plot >bootup.svg
 267 $ eog bootup.svg&amp;
 268 </programlisting>
 269       </example>
 270     </refsect2>
 271
 272     <refsect2>
 273       <title><command>systemd-analyze dot [<replaceable>pattern</replaceable>...]</command></title>
 274
 275       <para>This command generates textual dependency graph description in dot format for further processing
 276       with the GraphViz
 277       <citerefentry project='die-net'><refentrytitle>dot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 278       tool. Use a command line like <command>systemd-analyze dot | dot -Tsvg >systemd.svg</command> to
 279       generate a graphical dependency tree. Unless <option>--order</option> or <option>--require</option> is
 280       passed, the generated graph will show both ordering and requirement dependencies. Optional pattern
 281       globbing style specifications (e.g. <filename>*.target</filename>) may be given at the end. A unit
 282       dependency is included in the graph if any of these patterns match either the origin or destination
 283       node.</para>
 284
 285       <example>
 286         <title>Plot all dependencies of any unit whose name starts with <literal>avahi-daemon</literal>
 287         </title>
 288
 289         <programlisting>$ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg >avahi.svg
 290 $ eog avahi.svg</programlisting>
 291       </example>
 292
 293       <example>
 294         <title>Plot the dependencies between all known target units</title>
 295
 296         <programlisting>$ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' \
 297       | dot -Tsvg >targets.svg
 298 $ eog targets.svg</programlisting>
 299       </example>
 300     </refsect2>
 301
 302     <refsect2>
 303       <title><command>systemd-analyze unit-paths</command></title>
 304
 305       <para>This command outputs a list of all directories from which unit files, <filename>.d</filename>
 306       overrides, and <filename>.wants</filename>, <filename>.requires</filename> symlinks may be
 307       loaded. Combine with <option>--user</option> to retrieve the list for the user manager instance, and
 308       <option>--global</option> for the global configuration of user manager instances.</para>
 309
 310       <example>
 311         <title><command>Show all paths for generated units</command></title>
 312
 313         <programlisting>$ systemd-analyze unit-paths | grep '^/run'
 314 /run/systemd/system.control
 315 /run/systemd/transient
 316 /run/systemd/generator.early
 317 /run/systemd/system
 318 /run/systemd/system.attached
 319 /run/systemd/generator
 320 /run/systemd/generator.late
 321 </programlisting>
 322       </example>
 323
 324       <para>Note that this verb prints the list that is compiled into <command>systemd-analyze</command>
 325       itself, and does not communicate with the running manager. Use
 326       <programlisting>systemctl [--user] [--global] show -p UnitPath --value</programlisting>
 327       to retrieve the actual list that the manager uses, with any empty directories omitted.</para>
 328     </refsect2>
 329
 330     <refsect2>
 331       <title><command>systemd-analyze exit-status <optional><replaceable>STATUS</replaceable>...</optional></command></title>
 332
 333       <para>This command prints a list of exit statuses along with their "class", i.e. the source of the
 334       definition (one of <literal>glibc</literal>, <literal>systemd</literal>, <literal>LSB</literal>, or
 335       <literal>BSD</literal>), see the Process Exit Codes section in
 336       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 337       If no additional arguments are specified, all known statuses are are shown. Otherwise, only the
 338       definitions for the specified codes are shown.</para>
 339
 340       <example>
 341         <title><command>Show some example exit status names</command></title>
 342
 343         <programlisting>$ systemd-analyze exit-status 0 1 {63..65}
 344 NAME    STATUS CLASS
 345 SUCCESS 0      glibc
 346 FAILURE 1      glibc
 347 -       63     -
 348 USAGE   64     BSD
 349 DATAERR 65     BSD
 350 </programlisting>
 351       </example>
 352     </refsect2>
 353
 354     <refsect2>
 355       <title><command>systemd-analyze capability <optional><replaceable>CAPABILITY</replaceable>...</optional></command></title>
 356
 357       <para>This command prints a list of Linux capabilities along with their numeric IDs. See <citerefentry
 358       project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 359       for details. If no argument is specified the full list of capabilities known to the service manager and
 360       the kernel is shown. Capabilities defined by the kernel but not known to the service manager are shown
 361       as <literal>cap_???</literal>. Optionally, if arguments are specified they may refer to specific
 362       cabilities by name or numeric ID, in which case only the indicated capabilities are shown in the
 363       table.</para>
 364
 365       <example>
 366         <title><command>Show some example capability names</command></title>
 367
 368         <programlisting>$ systemd-analyze capability 0 1 {30..32}
 369 NAME              NUMBER
 370 cap_chown              0
 371 cap_dac_override       1
 372 cap_audit_control     30
 373 cap_setfcap           31
 374 cap_mac_override      32</programlisting>
 375       </example>
 376     </refsect2>
 377
 378     <refsect2>
 379       <title><command>systemd-analyze condition <replaceable>CONDITION</replaceable>...</command></title>
 380
 381       <para>This command will evaluate <varname index="false">Condition*=...</varname> and
 382       <varname index="false">Assert*=...</varname> assignments, and print their values, and
 383       the resulting value of the combined condition set. See
 384       <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 385       for a list of available conditions and asserts.</para>
 386
 387       <example>
 388         <title>Evaluate conditions that check kernel versions</title>
 389
 390         <programlisting>$ systemd-analyze condition 'ConditionKernelVersion = ! &lt;4.0' \
 391         'ConditionKernelVersion = &gt;=5.1' \
 392         'ConditionACPower=|false' \
 393         'ConditionArchitecture=|!arm' \
 394         'AssertPathExists=/etc/os-release'
 395 test.service: AssertPathExists=/etc/os-release succeeded.
 396 Asserts succeeded.
 397 test.service: ConditionArchitecture=|!arm succeeded.
 398 test.service: ConditionACPower=|false failed.
 399 test.service: ConditionKernelVersion=&gt;=5.1 succeeded.
 400 test.service: ConditionKernelVersion=!&lt;4.0 succeeded.
 401 Conditions succeeded.</programlisting>
 402       </example>
 403     </refsect2>
 404
 405     <refsect2>
 406       <title><command>systemd-analyze syscall-filter <optional><replaceable>SET</replaceable>...</optional></command></title>
 407
 408       <para>This command will list system calls contained in the specified system call set
 409       <replaceable>SET</replaceable>, or all known sets if no sets are specified. Argument
 410       <replaceable>SET</replaceable> must include the <literal>@</literal> prefix.</para>
 411     </refsect2>
 412
 413     <refsect2>
 414       <title><command>systemd-analyze calendar <replaceable>EXPRESSION</replaceable>...</command></title>
 415
 416       <para>This command will parse and normalize repetitive calendar time events, and will calculate when
 417       they elapse next. This takes the same input as the <varname>OnCalendar=</varname> setting in
 418       <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 419       following the syntax described in
 420       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. By
 421       default, only the next time the calendar expression will elapse is shown; use
 422       <option>--iterations=</option> to show the specified number of next times the expression
 423       elapses. Each time the expression elapses forms a timestamp, see the <command>timestamp</command>
 424       verb below.</para>
 425
 426       <example>
 427         <title>Show leap days in the near future</title>
 428
 429         <programlisting>$ systemd-analyze calendar --iterations=5 '*-2-29 0:0:0'
 430   Original form: *-2-29 0:0:0
 431 Normalized form: *-02-29 00:00:00
 432     Next elapse: Sat 2020-02-29 00:00:00 UTC
 433        From now: 11 months 15 days left
 434        Iter. #2: Thu 2024-02-29 00:00:00 UTC
 435        From now: 4 years 11 months left
 436        Iter. #3: Tue 2028-02-29 00:00:00 UTC
 437        From now: 8 years 11 months left
 438        Iter. #4: Sun 2032-02-29 00:00:00 UTC
 439        From now: 12 years 11 months left
 440        Iter. #5: Fri 2036-02-29 00:00:00 UTC
 441        From now: 16 years 11 months left
 442 </programlisting>
 443       </example>
 444     </refsect2>
 445
 446     <refsect2>
 447       <title><command>systemd-analyze timestamp <replaceable>TIMESTAMP</replaceable>...</command></title>
 448
 449       <para>This command parses a timestamp (i.e. a single point in time) and outputs the normalized form and
 450       the difference between this timestamp and now. The timestamp should adhere to the syntax documented in
 451       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 452       section "PARSING TIMESTAMPS".</para>
 453
 454       <example>
 455         <title>Show parsing of timestamps</title>
 456
 457         <programlisting>$ systemd-analyze timestamp yesterday now tomorrow
 458   Original form: yesterday
 459 Normalized form: Mon 2019-05-20 00:00:00 CEST
 460        (in UTC): Sun 2019-05-19 22:00:00 UTC
 461    UNIX seconds: @15583032000
 462        From now: 1 day 9h ago
 463
 464   Original form: now
 465 Normalized form: Tue 2019-05-21 09:48:39 CEST
 466        (in UTC): Tue 2019-05-21 07:48:39 UTC
 467    UNIX seconds: @1558424919.659757
 468        From now: 43us ago
 469
 470   Original form: tomorrow
 471 Normalized form: Wed 2019-05-22 00:00:00 CEST
 472        (in UTC): Tue 2019-05-21 22:00:00 UTC
 473    UNIX seconds: @15584760000
 474        From now: 14h left
 475 </programlisting>
 476       </example>
 477     </refsect2>
 478
 479     <refsect2>
 480       <title><command>systemd-analyze timespan <replaceable>EXPRESSION</replaceable>...</command></title>
 481
 482       <para>This command parses a time span (i.e. a difference between two timestamps) and outputs the
 483       normalized form and the equivalent value in microseconds. The time span should adhere to the syntax
 484       documented in
 485       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 486       section "PARSING TIME SPANS". Values without units are parsed as seconds.</para>
 487
 488       <example>
 489         <title>Show parsing of timespans</title>
 490
 491         <programlisting>$ systemd-analyze timespan 1s 300s '1year 0.000001s'
 492 Original: 1s
 493       μs: 1000000
 494    Human: 1s
 495
 496 Original: 300s
 497       μs: 300000000
 498    Human: 5min
 499
 500 Original: 1year 0.000001s
 501       μs: 31557600000001
 502    Human: 1y 1us
 503 </programlisting>
 504       </example>
 505     </refsect2>
 506
 507     <refsect2>
 508       <title><command>systemd-analyze cat-config</command>
 509       <replaceable>NAME</replaceable>|<replaceable>PATH</replaceable>...</title>
 510
 511       <para>This command is similar to <command>systemctl cat</command>, but operates on config files. It
 512       will copy the contents of a config file and any drop-ins to standard output, using the usual systemd
 513       set of directories and rules for precedence. Each argument must be either an absolute path including
 514       the prefix (such as <filename>/etc/systemd/logind.conf</filename> or
 515       <filename>/usr/lib/systemd/logind.conf</filename>), or a name relative to the prefix (such as
 516       <filename>systemd/logind.conf</filename>).</para>
 517
 518       <example>
 519         <title>Showing logind configuration</title>
 520         <programlisting>$ systemd-analyze cat-config systemd/logind.conf
 521 # /etc/systemd/logind.conf
 522 ...
 523 [Login]
 524 NAutoVTs=8
 525 ...
 526
 527 # /usr/lib/systemd/logind.conf.d/20-test.conf
 528 ... some override from another package
 529
 530 # /etc/systemd/logind.conf.d/50-override.conf
 531 ... some administrator override
 532         </programlisting>
 533       </example>
 534     </refsect2>
 535
 536     <refsect2>
 537       <title><command>systemd-analyze verify <replaceable>FILE</replaceable>...</command></title>
 538
 539       <para>This command will load unit files and print warnings if any errors are detected. Files specified
 540       on the command line will be loaded, but also any other units referenced by them. The full unit search
 541       path is formed by combining the directories for all command line arguments, and the usual unit load
 542       paths. The variable <varname>$SYSTEMD_UNIT_PATH</varname> is supported, and may be used to replace or
 543       augment the compiled in set of unit load paths; see
 544       <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. All
 545       units files present in the directories containing the command line arguments will be used in preference
 546       to the other paths.</para>
 547
 548       <para>The following errors are currently detected:</para>
 549       <itemizedlist>
 550         <listitem><para>unknown sections and directives,</para></listitem>
 551
 552         <listitem><para>missing dependencies which are required to start the given unit,</para></listitem>
 553
 554         <listitem><para>man pages listed in <varname>Documentation=</varname> which are not found in the
 555         system,</para></listitem>
 556
 557         <listitem><para>commands listed in <varname>ExecStart=</varname> and similar which are not found in
 558         the system or not executable.</para></listitem>
 559       </itemizedlist>
 560
 561       <example>
 562         <title>Misspelt directives</title>
 563
 564         <programlisting>$ cat ./user.slice
 565 [Unit]
 566 WhatIsThis=11
 567 Documentation=man:nosuchfile(1)
 568 Requires=different.service
 569
 570 [Service]
 571 Description=x
 572
 573 $ systemd-analyze verify ./user.slice
 574 [./user.slice:9] Unknown lvalue 'WhatIsThis' in section 'Unit'
 575 [./user.slice:13] Unknown section 'Service'. Ignoring.
 576 Error: org.freedesktop.systemd1.LoadFailed:
 577    Unit different.service failed to load:
 578    No such file or directory.
 579 Failed to create user.slice/start: Invalid argument
 580 user.slice: man nosuchfile(1) command failed with code 16
 581         </programlisting>
 582       </example>
 583
 584       <example>
 585         <title>Missing service units</title>
 586
 587         <programlisting>$ tail ./a.socket ./b.socket
 588 ==> ./a.socket &lt;==
 589 [Socket]
 590 ListenStream=100
 591
 592 ==> ./b.socket &lt;==
 593 [Socket]
 594 ListenStream=100
 595 Accept=yes
 596
 597 $ systemd-analyze verify ./a.socket ./b.socket
 598 Service a.service not loaded, a.socket cannot be started.
 599 Service b@0.service not loaded, b.socket cannot be started.
 600         </programlisting>
 601       </example>
 602     </refsect2>
 603
 604     <refsect2>
 605       <title><command>systemd-analyze security <optional><replaceable>UNIT</replaceable>...</optional></command></title>
 606
 607       <para>This command analyzes the security and sandboxing settings of one or more specified service
 608       units. If at least one unit name is specified the security settings of the specified service units are
 609       inspected and a detailed analysis is shown. If no unit name is specified, all currently loaded,
 610       long-running service units are inspected and a terse table with results shown. The command checks for
 611       various security-related service settings, assigning each a numeric "exposure level" value, depending
 612       on how important a setting is. It then calculates an overall exposure level for the whole unit, which
 613       is an estimation in the range 0.0…10.0 indicating how exposed a service is security-wise. High exposure
 614       levels indicate very little applied sandboxing. Low exposure levels indicate tight sandboxing and
 615       strongest security restrictions. Note that this only analyzes the per-service security features systemd
 616       itself implements. This means that any additional security mechanisms applied by the service code
 617       itself are not accounted for. The exposure level determined this way should not be misunderstood: a
 618       high exposure level neither means that there is no effective sandboxing applied by the service code
 619       itself, nor that the service is actually vulnerable to remote or local attacks. High exposure levels do
 620       indicate however that most likely the service might benefit from additional settings applied to
 621       them.</para>
 622
 623       <para>Please note that many of the security and sandboxing settings individually can be circumvented —
 624       unless combined with others. For example, if a service retains the privilege to establish or undo mount
 625       points many of the sandboxing options can be undone by the service code itself. Due to that is
 626       essential that each service uses the most comprehensive and strict sandboxing and security settings
 627       possible. The tool will take into account some of these combinations and relationships between the
 628       settings, but not all. Also note that the security and sandboxing settings analyzed here only apply to
 629       the operations executed by the service code itself. If a service has access to an IPC system (such as
 630       D-Bus) it might request operations from other services that are not subject to the same
 631       restrictions. Any comprehensive security and sandboxing analysis is hence incomplete if the IPC access
 632       policy is not validated too.</para>
 633
 634       <example>
 635       <title>Analyze <filename index="false">systemd-logind.service</filename></title>
 636
 637       <programlisting>$ systemd-analyze security --no-pager systemd-logind.service
 638   NAME                DESCRIPTION                              EXPOSURE
 639 ✗ PrivateNetwork=     Service has access to the host's network      0.5
 640 ✗ User=/DynamicUser=  Service runs as root user                     0.4
 641 ✗ DeviceAllow=        Service has no device ACL                     0.2
 642 ✓ IPAddressDeny=      Service blocks all IP address ranges
 643 ...
 644 → Overall exposure level for systemd-logind.service: 4.1 OK 🙂
 645 </programlisting>
 646       </example>
 647     </refsect2>
 648   </refsect1>
 649
 650   <refsect1>
 651     <title>Options</title>
 652
 653     <para>The following options are understood:</para>
 654
 655     <variablelist>
 656       <varlistentry>
 657         <term><option>--system</option></term>
 658
 659         <listitem><para>Operates on the system systemd instance. This
 660         is the implied default.</para></listitem>
 661       </varlistentry>
 662
 663       <varlistentry>
 664         <term><option>--user</option></term>
 665
 666         <listitem><para>Operates on the user systemd
 667         instance.</para></listitem>
 668       </varlistentry>
 669
 670       <varlistentry>
 671         <term><option>--global</option></term>
 672
 673         <listitem><para>Operates on the system-wide configuration for
 674         user systemd instance.</para></listitem>
 675       </varlistentry>
 676
 677       <varlistentry>
 678         <term><option>--order</option></term>
 679         <term><option>--require</option></term>
 680
 681         <listitem><para>When used in conjunction with the
 682         <command>dot</command> command (see above), selects which
 683         dependencies are shown in the dependency graph. If
 684         <option>--order</option> is passed, only dependencies of type
 685         <varname>After=</varname> or <varname>Before=</varname> are
 686         shown. If <option>--require</option> is passed, only
 687         dependencies of type <varname>Requires=</varname>,
 688         <varname>Requisite=</varname>,
 689         <varname>Wants=</varname> and <varname>Conflicts=</varname>
 690         are shown. If neither is passed, this shows dependencies of
 691         all these types.</para></listitem>
 692       </varlistentry>
 693
 694       <varlistentry>
 695         <term><option>--from-pattern=</option></term>
 696         <term><option>--to-pattern=</option></term>
 697
 698         <listitem><para>When used in conjunction with the
 699         <command>dot</command> command (see above), this selects which
 700         relationships are shown in the dependency graph. Both options
 701         require a
 702         <citerefentry project='man-pages'><refentrytitle>glob</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 703         pattern as an argument, which will be matched against the
 704         left-hand and the right-hand, respectively, nodes of a
 705         relationship.</para>
 706
 707         <para>Each of these can be used more than once, in which case
 708         the unit name must match one of the values. When tests for
 709         both sides of the relation are present, a relation must pass
 710         both tests to be shown. When patterns are also specified as
 711         positional arguments, they must match at least one side of the
 712         relation. In other words, patterns specified with those two
 713         options will trim the list of edges matched by the positional
 714         arguments, if any are given, and fully determine the list of
 715         edges shown otherwise.</para></listitem>
 716       </varlistentry>
 717
 718       <varlistentry>
 719         <term><option>--fuzz=</option><replaceable>timespan</replaceable></term>
 720
 721         <listitem><para>When used in conjunction with the
 722         <command>critical-chain</command> command (see above), also
 723         show units, which finished <replaceable>timespan</replaceable>
 724         earlier, than the latest unit in the same level. The unit of
 725         <replaceable>timespan</replaceable> is seconds unless
 726         specified with a different unit, e.g.
 727         "50ms".</para></listitem>
 728       </varlistentry>
 729
 730       <varlistentry>
 731         <term><option>--man=no</option></term>
 732
 733         <listitem><para>Do not invoke
 734         <citerefentry project='man-pages'><refentrytitle>man</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 735         to verify the existence of man pages listed in <varname>Documentation=</varname>.</para></listitem>
 736       </varlistentry>
 737
 738       <varlistentry>
 739         <term><option>--generators</option></term>
 740
 741         <listitem><para>Invoke unit generators, see
 742         <citerefentry><refentrytitle>systemd.generator</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
 743         Some generators require root privileges. Under a normal user, running with
 744         generators enabled will generally result in some warnings.</para></listitem>
 745       </varlistentry>
 746
 747       <varlistentry>
 748         <term><option>--root=<replaceable>PATH</replaceable></option></term>
 749
 750         <listitem><para>With <command>cat-files</command>, show config files underneath
 751         the specified root path <replaceable>PATH</replaceable>.</para></listitem>
 752       </varlistentry>
 753
 754       <varlistentry>
 755         <term><option>--iterations=<replaceable>NUMBER</replaceable></option></term>
 756
 757         <listitem><para>When used with the <command>calendar</command> command, show the specified number of
 758         iterations the specified calendar expression will elapse next. Defaults to 1.</para></listitem>
 759       </varlistentry>
 760
 761       <varlistentry>
 762         <term><option>--base-time=<replaceable>TIMESTAMP</replaceable></option></term>
 763
 764         <listitem><para>When used with the <command>calendar</command> command, show next iterations relative
 765         to the specified point in time. If not specified defaults to the current time.</para></listitem>
 766       </varlistentry>
 767
 768       <xi:include href="user-system-options.xml" xpointer="host" />
 769       <xi:include href="user-system-options.xml" xpointer="machine" />
 770
 771       <xi:include href="standard-options.xml" xpointer="help" />
 772       <xi:include href="standard-options.xml" xpointer="version" />
 773       <xi:include href="standard-options.xml" xpointer="no-pager" />
 774     </variablelist>
 775
 776   </refsect1>
 777
 778   <refsect1>
 779     <title>Exit status</title>
 780
 781     <para>On success, 0 is returned, a non-zero failure code
 782     otherwise.</para>
 783   </refsect1>
 784
 785   <xi:include href="less-variables.xml" />
 786
 787   <refsect1>
 788     <title>See Also</title>
 789     <para>
 790       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 791       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 792     </para>
 793   </refsect1>
 794
 795 </refentry>