Can systemd Show How Many Times a Service Restarted?

1. Overview

A service (also called a daemon) is a process or application running in the background. The operating system can start, stop, or restart any service during the system’s work. In this tutorial, we’ll learn how to determine how often a service has been restarted. That can help us detect some potential problems in the operating system functionality or its services.

2. Using systemd

Most Linux distributions use systemd for service management. systemd is a software suite that contains some commands to monitor and control services.

One of the most valuable commands is systemctl, which let us do various things such as viewing service status or starting, stopping, and restarting a service.

When a service is running, systemd stores some variables, including the restart counter for that service. We can access that counter by running systemctl with the show and -p options along with the service name:

$ sudo systemctl show bluetooth.service -p NRestarts
NRestarts=0

In the command above, the NRestarts parameter specifies the number of times the Bluetooth service has been automatically restarted.

Notably, the NRestarts counter is created and set to zero when the service starts. So, if we restart a service manually (by the user or other processes like during an update), not only does the counter not increase, but it also resets to zero. Therefore, we can conclude that NRestarts only shows the number of automatic restarts.

Let’s restart the Bluetooth service manually three times and see the results in NRestarts:

$ sudo systemctl restart bluetooth.service
$ sudo systemctl restart bluetooth.service
$ sudo systemctl restart bluetooth.service
$ sudo systemctl show bluetooth.service -p NRestarts
NRestarts=0

What if we want to determine all the number of times that a service has been restarted? We can do that using the journalctl command.

3. Using journalctl 

As systemd stores all logs, we can read and process the logs to find out the restart count for a service, i.e., both automatic and manual restarts.

systemd stores system logs in a binary format. So, to read logs that aren’t stored as plain text, we can use the journalctl command.

The journalctl command prints all system logs including systemd logs for all services. So, let’s filter the output of journalctl for a special unit by using the -u option followed by the service name:

$ sudo journalctl -u bluetooth.service
-- Logs begin at Tue 2023-05-09 09:17:03 +0330, end at Fri 2023-05-12 10:55:18 +0330. --
May 12 10:55:04 baeldung systemd[1]: Stopping Bluetooth service...
May 12 10:55:04 baeldung bluetoothd[548]: Terminating
May 12 10:55:05 baeldung bluetoothd[548]: Endpoint unregistered: sender=:1.14 path=/org/bluez/hci0/A2DP/SBC/Source/1
May 12 10:55:05 baeldung bluetoothd[548]: Endpoint unregistered: sender=:1.14 path=/org/bluez/hci0/A2DP/SBC/Source/2
May 12 10:55:05 baeldung bluetoothd[548]: Stopping SDP server
May 12 10:55:05 baeldung bluetoothd[548]: Exit
May 12 10:55:05 baeldung systemd[1]: bluetooth.service: Succeeded.
May 12 10:55:05 baeldung systemd[1]: Stopped Bluetooth service.
May 12 10:55:06 baeldung systemd[1]: Starting Bluetooth service...
May 12 10:55:06 baeldung bluetoothd[1457]: Bluetooth daemon 5.50
May 12 10:55:06 baeldung systemd[1]: Started Bluetooth service.
May 12 10:55:06 baeldung bluetoothd[1457]: Starting SDP server
May 12 10:55:06 baeldung bluetoothd[1457]: Bluetooth management interface 1.18 initialized
May 12 10:55:06 baeldung bluetoothd[1457]: Failed to set privacy: Rejected (0x0b)
May 12 10:55:07 baeldung bluetoothd[1457]: Endpoint registered: sender=:1.321085 path=/org/bluez/hci0/A2DP/SBC/Source/1
May 12 10:55:07 baeldung bluetoothd[1457]: Endpoint registered: sender=:1.321085 path=/org/bluez/hci0/A2DP/SBC/Source/2
May 12 10:55:09 baeldung bluetoothd[1457]: Endpoint unregistered: sender=:1.321085 path=/org/bluez/hci0/A2DP/SBC/Source/1
May 12 10:55:09 baeldung bluetoothd[1457]: Endpoint unregistered: sender=:1.321085 path=/org/bluez/hci0/A2DP/SBC/Source/2
May 12 10:55:09 baeldung bluetoothd[1457]: Terminating
......

As we can see there may be many logs for a service. We need lines that are related to starting a service which should be in the “Starting [service name] service…” format. Therefore, we can filter results by using grep:

$ sudo journalctl -u bluetooth.service | grep "Starting Bluetooth service..."
May 12 10:55:06 baeldung systemd[1]: Starting Bluetooth service...
May 12 10:55:09 baeldung systemd[1]: Starting Bluetooth service...
May 12 10:55:11 baeldung systemd[1]: Starting Bluetooth service...

Then, we can count the lines using the wc command with the -l option to see how many times that service has been restarted:

$ sudo journalctl -u bluetooth.service | grep "Starting Bluetooth service..." | wc -l
3

4. Conclusion

In this article, we learned how to find the restart count for a service.

We saw that services can be restarted manually by the user or through other processes such as updates, or automatically after failure. We used the systemctl command to count the number of automatic restarts of a service.

Then, we looked at the system log to find out the total number of times that a service has been restarted either manually or automatically.