There are many ways as well as tools to check and list all running services in Linux.
Most Linux administrators typically use ‘service service_name status’ or ‘/etc/init.d/service_name status’ for the System V (SysV) init system, and ‘systemctl status service_name’ for the systemd systems for a specific service.
The above commands show whether the particular service is running on the server or not. These are frequently used commands by every Linux administrator.
If you are new to the environment and want to know what services are running on the system, continue to read.
The following commands lists all the services running on the system and give you an idea of what purpose the system is being used for. Also, it provides an opportunity to disable certain services that are not used on the system.
‘init’ (short for initialization) is the first process started during booting of the computer system. init is a daemon process that continues running until the system is shut down.
We recommend reading the following articles related to this topic.
- How to configure systemd to start a service automatically after a crash in Linux
- Bash script to automatically start a services when it goes down on Linux
- How to determine which system manager is running on Linux System
- How to Enable / Disable services on Boot in Linux using chkconfig and systemctl commands?
- SysVinit Vs systemd Cheatsheet
Many init systems have been developed for Linux, but the following are the three most familiar and commonly used init systems.
- System V (Sys V) is the older init system
- Upstart is an event-based replacement for the traditional init system
- systemd is the new init system, that was adopted by most of the latest Linux distributions
Method-1: Listing Linux Running Services with service command
To display the status of all available services at once in the System V (SysV) init system, run the service command with the --status-all option:
If you have multiple services, use file display commands (like less or more) for page-wise viewing. The following command will show the below information in the output.
- Running services and their associated PID
- Stopped services
- Configured iptables rules
- Configured and active network interface information.
# service --status-all
or
# service --status-all | more
or
# service --status-all | less
abrt-ccpp hook is installed
abrtd (pid 2131) is running...
abrt-dump-oops is stopped
acpid (pid 1958) is running...
atd (pid 2164) is running...
auditd (pid 1731) is running...
Frequency scaling enabled using ondemand governor
crond (pid 2153) is running...
hald (pid 1967) is running...
htcacheclean is stopped
httpd is stopped
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all ::/0 ::/0 state RELATED,ESTABLISHED
2 ACCEPT icmpv6 ::/0 ::/0
3 ACCEPT all ::/0 ::/0
4 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:80
5 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:21
6 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:22
7 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:25
8 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:2082
9 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:2086
10 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:2083
11 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:2087
12 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:10000
13 REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
iptables: Firewall is not running.
irqbalance (pid 1826) is running...
Kdump is operational
lvmetad is stopped
mdmonitor is stopped
messagebus (pid 1929) is running...
SUCCESS! MySQL running (24376)
rndc: neither /etc/rndc.conf nor /etc/rndc.key was found
named is stopped
netconsole module not loaded
Usage: startup.sh { start | stop }
Configured devices:
lo eth0 eth1
Currently active devices:
lo eth0
ntpd is stopped
portreserve (pid 1749) is running...
master (pid 2107) is running...
Process accounting is disabled.
quota_nld is stopped
rdisc is stopped
rngd is stopped
rpcbind (pid 1840) is running...
rsyslogd (pid 1756) is running...
sandbox is stopped
saslauthd is stopped
smartd is stopped
openssh-daemon (pid 9859) is running...
svnserve is stopped
vsftpd (pid 4008) is running...
xinetd (pid 2031) is running...
zabbix_agentd (pid 2150 2149 2148 2147 2146 2140) is running...
Run the following command to see only running services in the system.
# service --status-all | grep running crond (pid 535) is running... httpd (pid 627) is running... mysqld (pid 911) is running... rndc: neither /etc/rndc.conf nor /etc/rndc.key was found rsyslogd (pid 449) is running... saslauthd (pid 492) is running... sendmail (pid 509) is running... sm-client (pid 519) is running... openssh-daemon (pid 478) is running... xinetd (pid 485) is running...
Run the following command to see the specified service status. For instance, use the following command to check the Apache Web server status on a RHEL based system.
# service --status-all | grep httpd httpd (pid 627) is running...
To determine the current status of a particular service, execute the following command.
# service httpd status httpd (pid 627) is running...
Use the following command to see a list of services that were enabled on boot. These services will be kicked on as part of the system boot process.
# chkconfig --list
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
htcacheclean 0:off 1:off 2:off 3:off 4:off 5:off 6:off
httpd 0:off 1:off 2:off 3:on 4:off 5:off 6:off
ip6tables 0:off 1:off 2:on 3:off 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
modules_dep 0:off 1:off 2:on 3:on 4:on 5:on 6:off
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
named 0:off 1:off 2:off 3:off 4:off 5:off 6:off
netconsole 0:off 1:off 2:off 3:off 4:off 5:off 6:off
netfs 0:off 1:off 2:off 3:off 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
nmb 0:off 1:off 2:off 3:off 4:off 5:off 6:off
nscd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
portreserve 0:off 1:off 2:on 3:off 4:on 5:on 6:off
quota_nld 0:off 1:off 2:off 3:off 4:off 5:off 6:off
rdisc 0:off 1:off 2:off 3:off 4:off 5:off 6:off
restorecond 0:off 1:off 2:off 3:off 4:off 5:off 6:off
rpcbind 0:off 1:off 2:on 3:off 4:on 5:on 6:off
rsyslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
saslauthd 0:off 1:off 2:off 3:on 4:off 5:off 6:off
sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off
smb 0:off 1:off 2:off 3:off 4:off 5:off 6:off
snmpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
snmptrapd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
udev-post 0:off 1:on 2:on 3:off 4:on 5:on 6:off
winbind 0:off 1:off 2:off 3:off 4:off 5:off 6:off
xinetd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
xinetd based services:
chargen-dgram: off
chargen-stream: off
daytime-dgram: off
daytime-stream: off
discard-dgram: off
discard-stream: off
echo-dgram: off
echo-stream: off
finger: off
ntalk: off
rsync: off
talk: off
tcpmux-server: off
time-dgram: off
time-stream: off
Method-1(a): How to check running services in System V (SysV) init System
Alternatively, you can view services running on a Linux system by issuing the ‘initctl’ command as shown below.
# initctl list rc stop/waiting tty (/dev/tty3) start/running, process 1740 tty (/dev/tty2) start/running, process 1738 tty (/dev/tty1) start/running, process 1736 tty (/dev/tty6) start/running, process 1746 tty (/dev/tty5) start/running, process 1744 tty (/dev/tty4) start/running, process 1742 plymouth-shutdown stop/waiting control-alt-delete stop/waiting rcS-emergency stop/waiting readahead-collector stop/waiting kexec-disable stop/waiting quit-plymouth stop/waiting rcS stop/waiting prefdm stop/waiting init-system-dbus stop/waiting ck-log-system-restart stop/waiting readahead stop/waiting ck-log-system-start stop/waiting splash-manager stop/waiting start-ttys stop/waiting readahead-disable-services stop/waiting ck-log-system-stop stop/waiting rcS-sulogin stop/waiting serial stop/waiting
Method-1(b): How to check running services in Linux with pstree command
Run the ‘pstree’ command without any additional parameter to see services running in the Linux system:
# pstree
init-+-crond
|-httpd---2*[httpd]
|-kthreadd/99149---khelper/99149
|-2*[mingetty]
|-mysqld_safe---mysqld---9*[{mysqld}]
|-rsyslogd---3*[{rsyslogd}]
|-saslauthd---saslauthd
|-2*[sendmail]
|-sshd---sshd---bash---pstree
|-udevd
`-xinetd
Method-2: How to check running services in systemd system using the systemctl command
‘systemctl’ command allows users to check and list all services running in a Linux system that uses “systemd” as the system manager.
# systemctl UNIT LOAD ACTIVE SUB DESCRIPTION sys-devices-virtual-block-loop0.device loaded active plugged /sys/devices/virtual/block/loop0 sys-devices-virtual-block-loop1.device loaded active plugged /sys/devices/virtual/block/loop1 sys-devices-virtual-block-loop2.device loaded active plugged /sys/devices/virtual/block/loop2 sys-devices-virtual-block-loop3.device loaded active plugged /sys/devices/virtual/block/loop3 sys-devices-virtual-block-loop4.device loaded active plugged /sys/devices/virtual/block/loop4 sys-devices-virtual-misc-rfkill.device loaded active plugged /sys/devices/virtual/misc/rfkill sys-devices-virtual-tty-ttyprintk.device loaded active plugged /sys/devices/virtual/tty/ttyprintk sys-module-fuse.device loaded active plugged /sys/module/fuse sys-subsystem-net-devices-enp0s3.device loaded active plugged 82540EM Gigabit Ethernet Controller (PRO/1000 MT Desktop Adapter) -.mount loaded active mounted Root Mount dev-hugepages.mount loaded active mounted Huge Pages File System dev-mqueue.mount loaded active mounted POSIX Message Queue File System run-user-1000-gvfs.mount loaded active mounted /run/user/1000/gvfs run-user-1000.mount loaded active mounted /run/user/1000 snap-core-3887.mount loaded active mounted Mount unit for core snap-core-4017.mount loaded active mounted Mount unit for core snap-core-4110.mount loaded active mounted Mount unit for core snap-gping-13.mount loaded active mounted Mount unit for gping snap-termius\x2dapp-8.mount loaded active mounted Mount unit for termius-app sys-fs-fuse-connections.mount loaded active mounted FUSE Control File System sys-kernel-debug.mount loaded active mounted Debug File System acpid.path loaded active running ACPI Events Check cups.path loaded active running CUPS Scheduler systemd-ask-password-plymouth.path loaded active waiting Forward Password Requests to Plymouth Directory Watch systemd-ask-password-wall.path loaded active waiting Forward Password Requests to Wall Directory Watch init.scope loaded active running System and Service Manager session-c2.scope loaded active running Session c2 of user magi accounts-daemon.service loaded active running Accounts Service acpid.service loaded active running ACPI event daemon anacron.service loaded active running Run anacron jobs apache2.service loaded active running The Apache HTTP Server apparmor.service loaded active exited AppArmor initialization apport.service loaded active exited LSB: automatic crash report generation aptik-battery-monitor.service loaded active running LSB: start/stop the aptik battery monitor daemon atop.service loaded active running Atop advanced performance monitor atopacct.service loaded active running Atop process accounting daemon avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack colord.service loaded active running Manage, Install and Generate Color Profiles console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon cups-browsed.service loaded active running Make remote CUPS printers available locally cups.service loaded active running CUPS Scheduler dbus.service loaded active running D-Bus System Message Bus postfix.service loaded active exited Postfix Mail Transport Agent
UNITDescribe about the corresponding systemd unit name.LOADDescribes whether the corresponding unit currently loaded in memory or not.ACTIVEIndicate whether the unit is active or not.SUBIndicate whether the unit is in running state or not.DESCRIPTIONA short description about the unit.
To see loaded service in the system, use the list-units subcommand and the --type switch with a value of service. It shows active, running, exited or failed services in the output.
# systemctl list-units --type service UNIT LOAD ACTIVE SUB DESCRIPTION accounts-daemon.service loaded active running Accounts Service acpid.service loaded active running ACPI event daemon anacron.service loaded active running Run anacron jobs apache2.service loaded active running The Apache HTTP Server apparmor.service loaded active exited AppArmor initialization apport.service loaded active exited LSB: automatic crash report generation aptik-battery-monitor.service loaded active running LSB: start/stop the aptik battery monitor daemon atop.service loaded active running Atop advanced performance monitor atopacct.service loaded active running Atop process accounting daemon avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack colord.service loaded active running Manage, Install and Generate Color Profiles console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon cups-browsed.service loaded active running Make remote CUPS printers available locally cups.service loaded active running CUPS Scheduler dbus.service loaded active running D-Bus System Message Bus fwupd.service loaded active running Firmware update daemon getty@tty1.service loaded active running Getty on tty1 grub-common.service loaded active exited LSB: Record successful boot for GRUB irqbalance.service loaded active running LSB: daemon to balance interrupts for SMP systems keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create list of required static device nodes for the current kernel
Run the following command to view a particular service status.
# systemctl | grep apache2 apache2.service loaded active running The Apache HTTP Server
Detailed information about a particular service can be verified with the systemctl command as shown below.
# systemctl status apache2
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
Drop-In: /lib/systemd/system/apache2.service.d
└─apache2-systemd.conf
Active: active (running) since Tue 2018-03-06 12:34:09 IST; 8min ago
Process: 2786 ExecReload=/usr/sbin/apachectl graceful (code=exited, status=0/SUCCESS)
Main PID: 1171 (apache2)
Tasks: 55 (limit: 4915)
CGroup: /system.slice/apache2.service
├─1171 /usr/sbin/apache2 -k start
├─2790 /usr/sbin/apache2 -k start
└─2791 /usr/sbin/apache2 -k start
Mar 06 12:34:08 magi-VirtualBox systemd[1]: Starting The Apache HTTP Server...
Mar 06 12:34:09 magi-VirtualBox apachectl[1089]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.0.2.15. Set the 'ServerName' directive globally to suppre
Mar 06 12:34:09 magi-VirtualBox systemd[1]: Started The Apache HTTP Server.
Mar 06 12:39:10 magi-VirtualBox systemd[1]: Reloading The Apache HTTP Server.
Mar 06 12:39:10 magi-VirtualBox apachectl[2786]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using fe80::7929:4ed1:279f:4d65. Set the 'ServerName' directive gl
Mar 06 12:39:10 magi-VirtualBox systemd[1]: Reloaded The Apache HTTP Server.
Run the following command to view the services running on the system with the systemctl command:
# systemctl list-units --type=service --state=running or # systemctl | grep running acpid.path loaded active running ACPI Events Check cups.path loaded active running CUPS Scheduler init.scope loaded active running System and Service Manager session-c2.scope loaded active running Session c2 of user magi accounts-daemon.service loaded active running Accounts Service acpid.service loaded active running ACPI event daemon apache2.service loaded active running The Apache HTTP Server aptik-battery-monitor.service loaded active running LSB: start/stop the aptik battery monitor daemon atop.service loaded active running Atop advanced performance monitor atopacct.service loaded active running Atop process accounting daemon avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack colord.service loaded active running Manage, Install and Generate Color Profiles cron.service loaded active running Regular background program processing daemon cups-browsed.service loaded active running Make remote CUPS printers available locally cups.service loaded active running CUPS Scheduler dbus.service loaded active running D-Bus System Message Bus fwupd.service loaded active running Firmware update daemon getty@tty1.service loaded active running Getty on tty1 irqbalance.service loaded active running LSB: daemon to balance interrupts for SMP systems lightdm.service loaded active running Light Display Manager ModemManager.service loaded active running Modem Manager NetworkManager.service loaded active running Network Manager polkit.service loaded active running Authorization Manager
Use the below command to see which services were enabled on boot:
# systemctl list-unit-files --state=enabled acpid.path enabled cups.path enabled accounts-daemon.service enabled anacron-resume.service enabled anacron.service enabled apache2.service enabled apparmor.service enabled atop.service enabled atopacct.service enabled autovt@.service enabled avahi-daemon.service enabled bluetooth.service enabled console-setup.service enabled cron.service enabled cups-browsed.service enabled cups.service enabled display-manager.service enabled dns-clean.service enabled friendly-recovery.service enabled getty@.service enabled gpu-manager.service enabled keyboard-setup.service enabled lightdm.service enabled ModemManager.service enabled network-manager.service enabled networking.service enabled NetworkManager-dispatcher.service enabled NetworkManager-wait-online.service enabled NetworkManager.service enabled
systemd-cgtop shows top control groups by their resource usage such as tasks, CPU, Memory, Input, and Output:
# systemd-cgtop Control Group Tasks %CPU Memory Input/s Output/s / - - 1.5G - - /init.scope 1 - - - - /system.slice 153 - - - - /system.slice/ModemManager.service 3 - - - - /system.slice/NetworkManager.service 4 - - - - /system.slice/accounts-daemon.service 3 - - - - /system.slice/acpid.service 1 - - - - /system.slice/apache2.service 55 - - - - /system.slice/aptik-battery-monitor.service 1 - - - - /system.slice/atop.service 1 - - - - /system.slice/atopacct.service 1 - - - - /system.slice/avahi-daemon.service 2 - - - - /system.slice/colord.service 3 - - - - /system.slice/cron.service 1 - - - - /system.slice/cups-browsed.service 3 - - - - /system.slice/cups.service 2 - - - - /system.slice/dbus.service 6 - - - - /system.slice/fwupd.service 5 - - - - /system.slice/irqbalance.service 1 - - - - /system.slice/lightdm.service 7 - - - - /system.slice/polkit.service 3 - - - - /system.slice/repowerd.service 14 - - - - /system.slice/rsyslog.service 4 - - - - /system.slice/rtkit-daemon.service 3 - - - - /system.slice/snapd.service 8 - - - - /system.slice/system-getty.slice 1 - - - -
Method-2(a): Listing Linux services with pstree command
List of services running in a Linux system can be verified using the ‘pstree’ command as shown below.
# pstree
systemd─┬─ModemManager─┬─{gdbus}
│ └─{gmain}
├─NetworkManager─┬─dhclient
│ ├─{gdbus}
│ └─{gmain}
├─accounts-daemon─┬─{gdbus}
│ └─{gmain}
├─acpid
├─agetty
├─anacron
├─apache2───2*[apache2───26*[{apache2}]]
├─aptd───{gmain}
├─aptik-battery-m
├─atop
├─atopacctd
├─avahi-daemon───avahi-daemon
├─colord─┬─{gdbus}
│ └─{gmain}
├─cron
├─cups-browsed─┬─{gdbus}
│ └─{gmain}
├─cupsd
├─dbus-daemon
├─fwupd─┬─{GUsbEventThread}
│ ├─{fwupd}
│ ├─{gdbus}
│ └─{gmain}
├─gnome-keyring-d─┬─{gdbus}
│ ├─{gmain}
│ └─{timer}
Method-2(b): Listing Linux Services with chkservice command
chkservice is a new tool for managing systemd units in terminal. It requires super user privileges to manage the units.
# chkservice
To view the help page, hit '?' button. This will show you available options to manage the systemd services.
Conclusion
This article explained several ways to check and list all running Linux services.
If you have any questions or feedback, feel free to comment below.
Thanks for your valuable information.
I also want to know if there is any command to see any vulnerable / risk services running.
What is the command used to check vulnerable / risk or any negative services running..
Thanks in advance.
Hi @Ashok,
I hope, nmap & openscap commands can fulfill your requirements.
Thanks!
Useful Information.. Keep learning, keep sharing..
Thanks, you are welcome.