How do you read the output of systemctl status?
The header shows Loaded (unit file path and whether it is enabled) and Active (running, inactive or failed, with how long). Below come the main PID, memory and CPU use, the process tree and the last log lines, which usually reveal why a service failed.
Explain it simply
systemctl status is the health card of a service. Read it top to bottom.
- Loaded: where the unit file is and
enabledordisabled.loadedwithvendor presettells you the distribution default. - Active: the state.
active (running)is healthy;active (exited)means a one-shot task finished fine;inactive (dead)is stopped;failedmeans it crashed or exited with an error;activating (auto-restart)means it is in a crash loop. - Main PID: process ID and command.
- Tasks, Memory, CPU: resource use from its control group.
- CGroup: the tree of processes belonging to the service.
- The last lines: recent log messages from the journal. This is usually where the clue is, for example "Permission denied" or "Address already in use".
If those lines are cut off, use systemctl status name -l --no-pager or go to journalctl -u name -e for the full log.
Exit codes appear too: status=203/EXEC means ExecStart could not be run, often a wrong path.
Example
systemctl status myapp --no-pager
# Active: failed (Result: exit-code) since Mon 2026-10-05 10:12:03 IST
# Process: 2210 ExecStart=/usr/bin/node server.js (code=exited, status=1/FAILURE)
# node[2210]: Error: listen EADDRINUSE: address already in use :::3000What to say in the interview
"I check Loaded for enabled state, Active for running or failed, then the exit status and the final log lines, which usually show the cause. For deeper history I use journalctl -u. Something like status=203/EXEC points to a bad ExecStart path."
Common mistakes
- Looking only at 'enabled' and assuming the service is running.