Practical, command-line ways to list and inspect the daemons running on a Linux host. 16.11.2025 | reading time: 3 min When a service misbehaves or a server feels slow, he must first know which daemons are running; this short guide shows how to discover running services with concrete commands and outputs so he can act immediately. Quick systemd scan Run a quick systemd listing and map network listeners to processes to see which daemons are active and accepting connections; example session: ```bash $ sudo systemctl list-units --type=service --state=running UNIT LOAD ACTIVE SUB DESCRIPTION sshd.service loaded active running OpenSSH Daemon nginx.service loaded active running A high performance web server cron.service loaded active running Regular background program processing $ sudo ss -ltnp State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=1234,fd=3) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:("nginx",pid=2345,fd=6) ``` When systemd is absent On older or minimal systems use process listings and service wrappers to find daemons; example: ```bash $ ps aux --sort=-%mem | head -n 8 root 1 0.0 0.1 22528 3456 ? Ss 08:00 0:01 /sbin/init root 1234 0.0 0.3 34500 7890 ? Ss 08:02 0:00 /usr/sbin/sshd -D www 2345 0.1 1.2 234000 45600 ? S 08:03 0:10 nginx: master process $ sudo service --status-all 2>&1 | head -n 6 [ + ] sshd [ + ] cron [ - ] some-legacy-daemon ``` Investigate a single daemon Once a suspicious daemon is found, inspect its unit and logs to understand state and failures; try commands like systemctl status and journalctl with concrete example output: ```bash $ sudo systemctl status sshd ● sshd.service - OpenSSH Daemon Loaded: loaded (/lib/systemd/system/sshd.service; enabled) Active: active (running) since Mon 2025-11-16 08:02:11; 2h 3min ago Main PID: 1234 (sshd) $ sudo journalctl -u sshd --since "1 hour ago" | tail -n 5 Nov 16 09:00:01 server sshd[4321]: Accepted password for user from 10.0.0.5 port 53712 ssh2 ``` Other angles that matter Check socket activation, enabled/disabled state and masks, correlate PIDs with files in /proc, inspect parent-child trees with pstree and find processes by name with pgrep so he can decide whether to restart, stop, or investigate resource usage. Next steps Regular checks, automated alerts and a clear playbook turn discovery into action; keep practising these commands and consider formalizing knowledge with focused training and certifications to deepen skills. Join Bits & Bytes Academy First class LINUX exam preparation. processes boot-process troubleshooting utilities network
