How to check all running services in Linux

There are many ways as well as tools to check and list all running services in Linux.

Most Linux administrators typically use ‘service service_name status’ or ‘/etc/init.d/service_name status’ for the System V (SysV) init system, and ‘systemctl status service_name’ for the systemd systems for a specific service.

The above commands show whether the particular service is running on the server or not. These are frequently used commands by every Linux administrator.

If you are new to the environment and want to know what services are running on the system, continue to read.

The following commands lists all the services running on the system and give you an idea of what purpose the system is being used for. Also, it provides an opportunity to disable certain services that are not used on the system.

init’ (short for initialization) is the first process started during booting of the computer system. init is a daemon process that continues running until the system is shut down.

We recommend reading the following articles related to this topic.

Many init systems have been developed for Linux, but the following are the three most familiar and commonly used init systems.

  • System V (Sys V) is the older init system
  • Upstart is an event-based replacement for the traditional init system
  • systemd is the new init system, that was adopted by most of the latest Linux distributions

Method-1: Listing Linux Running Services with service command

To display the status of all available services at once in the System V (SysV) init system, run the service command with the --status-all option:

If you have multiple services, use file display commands (like less or more) for page-wise viewing. The following command will show the below information in the output.

  • Running services and their associated PID
  • Stopped services
  • Configured iptables rules
  • Configured and active network interface information.
# service --status-all
or
# service --status-all | more
or
# service --status-all | less

abrt-ccpp hook is installed
abrtd (pid  2131) is running...
abrt-dump-oops is stopped
acpid (pid  1958) is running...
atd (pid  2164) is running...
auditd (pid  1731) is running...
Frequency scaling enabled using ondemand governor
crond (pid  2153) is running...
hald (pid  1967) is running...
htcacheclean is stopped
httpd is stopped
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all      ::/0                 ::/0                state RELATED,ESTABLISHED
2    ACCEPT     icmpv6    ::/0                 ::/0
3    ACCEPT     all      ::/0                 ::/0
4    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:80
5    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:21
6    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:22
7    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:25
8    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:2082
9    ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:2086
10   ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:2083
11   ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:2087
12   ACCEPT     tcp      ::/0                 ::/0                state NEW tcp dpt:10000
13   REJECT     all      ::/0                 ::/0                reject-with icmp6-adm-prohibited

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    REJECT     all      ::/0                 ::/0                reject-with icmp6-adm-prohibited

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

iptables: Firewall is not running.
irqbalance (pid 1826) is running...
Kdump is operational
lvmetad is stopped
mdmonitor is stopped
messagebus (pid  1929) is running...
 SUCCESS! MySQL running (24376)
rndc: neither /etc/rndc.conf nor /etc/rndc.key was found
named is stopped
netconsole module not loaded
Usage: startup.sh { start | stop }
Configured devices:
lo eth0 eth1
Currently active devices:
lo eth0
ntpd is stopped
portreserve (pid  1749) is running...
master (pid  2107) is running...
Process accounting is disabled.
quota_nld is stopped
rdisc is stopped
rngd is stopped
rpcbind (pid  1840) is running...
rsyslogd (pid  1756) is running...
sandbox is stopped
saslauthd is stopped
smartd is stopped
openssh-daemon (pid  9859) is running...
svnserve is stopped
vsftpd (pid 4008) is running...
xinetd (pid  2031) is running...
zabbix_agentd (pid 2150 2149 2148 2147 2146 2140) is running...

Run the following command to see only running services in the system.

# service --status-all | grep running

crond (pid  535) is running...
httpd (pid  627) is running...
mysqld (pid  911) is running...
rndc: neither /etc/rndc.conf nor /etc/rndc.key was found
rsyslogd (pid  449) is running...
saslauthd (pid  492) is running...
sendmail (pid  509) is running...
sm-client (pid  519) is running...
openssh-daemon (pid  478) is running...
xinetd (pid  485) is running...

Run the following command to see the specified service status. For instance, use the following command to check the Apache Web server status on a RHEL based system.

#  service --status-all | grep httpd

httpd (pid  627) is running...

To determine the current status of a particular service, execute the following command.

# service httpd status

httpd (pid  627) is running...

Use the following command to see a list of services that were enabled on boot. These services will be kicked on as part of the system boot process.

# chkconfig --list

crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
htcacheclean    0:off   1:off   2:off   3:off   4:off   5:off   6:off
httpd           0:off   1:off   2:off   3:on    4:off   5:off   6:off
ip6tables       0:off   1:off   2:on    3:off   4:on    5:on    6:off
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
modules_dep     0:off   1:off   2:on    3:on    4:on    5:on    6:off
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off
named           0:off   1:off   2:off   3:off   4:off   5:off   6:off
netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off
netfs           0:off   1:off   2:off   3:off   4:on    5:on    6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
nmb             0:off   1:off   2:off   3:off   4:off   5:off   6:off
nscd            0:off   1:off   2:off   3:off   4:off   5:off   6:off
portreserve     0:off   1:off   2:on    3:off   4:on    5:on    6:off
quota_nld       0:off   1:off   2:off   3:off   4:off   5:off   6:off
rdisc           0:off   1:off   2:off   3:off   4:off   5:off   6:off
restorecond     0:off   1:off   2:off   3:off   4:off   5:off   6:off
rpcbind         0:off   1:off   2:on    3:off   4:on    5:on    6:off
rsyslog         0:off   1:off   2:on    3:on    4:on    5:on    6:off
saslauthd       0:off   1:off   2:off   3:on    4:off   5:off   6:off
sendmail        0:off   1:off   2:on    3:on    4:on    5:on    6:off
smb             0:off   1:off   2:off   3:off   4:off   5:off   6:off
snmpd           0:off   1:off   2:off   3:off   4:off   5:off   6:off
snmptrapd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
udev-post       0:off   1:on    2:on    3:off   4:on    5:on    6:off
winbind         0:off   1:off   2:off   3:off   4:off   5:off   6:off
xinetd          0:off   1:off   2:off   3:on    4:on    5:on    6:off

xinetd based services:
        chargen-dgram:  off
        chargen-stream: off
        daytime-dgram:  off
        daytime-stream: off
        discard-dgram:  off
        discard-stream: off
        echo-dgram:     off
        echo-stream:    off
        finger:         off
        ntalk:          off
        rsync:          off
        talk:           off
        tcpmux-server:  off
        time-dgram:     off
        time-stream:    off

Method-1(a): How to check running services in System V (SysV) init System

Alternatively, you can view services running on a Linux system by issuing the ‘initctl’ command as shown below.

# initctl list

rc stop/waiting
tty (/dev/tty3) start/running, process 1740
tty (/dev/tty2) start/running, process 1738
tty (/dev/tty1) start/running, process 1736
tty (/dev/tty6) start/running, process 1746
tty (/dev/tty5) start/running, process 1744
tty (/dev/tty4) start/running, process 1742
plymouth-shutdown stop/waiting
control-alt-delete stop/waiting
rcS-emergency stop/waiting
readahead-collector stop/waiting
kexec-disable stop/waiting
quit-plymouth stop/waiting
rcS stop/waiting
prefdm stop/waiting
init-system-dbus stop/waiting
ck-log-system-restart stop/waiting
readahead stop/waiting
ck-log-system-start stop/waiting
splash-manager stop/waiting
start-ttys stop/waiting
readahead-disable-services stop/waiting
ck-log-system-stop stop/waiting
rcS-sulogin stop/waiting
serial stop/waiting

Method-1(b): How to check running services in Linux with pstree command

Run the ‘pstree’ command without any additional parameter to see services running in the Linux system:

# pstree

init-+-crond
     |-httpd---2*[httpd]
     |-kthreadd/99149---khelper/99149
     |-2*[mingetty]
     |-mysqld_safe---mysqld---9*[{mysqld}]
     |-rsyslogd---3*[{rsyslogd}]
     |-saslauthd---saslauthd
     |-2*[sendmail]
     |-sshd---sshd---bash---pstree
     |-udevd
     `-xinetd

Method-2: How to check running services in systemd system using the systemctl command

‘systemctl’ command allows users to check and list all services running in a Linux system that uses “systemd” as the system manager.

# systemctl

  UNIT                                                                                     LOAD   ACTIVE SUB       DESCRIPTION                                                      
  sys-devices-virtual-block-loop0.device                                                   loaded active plugged   /sys/devices/virtual/block/loop0                                 
  sys-devices-virtual-block-loop1.device                                                   loaded active plugged   /sys/devices/virtual/block/loop1                                 
  sys-devices-virtual-block-loop2.device                                                   loaded active plugged   /sys/devices/virtual/block/loop2                                 
  sys-devices-virtual-block-loop3.device                                                   loaded active plugged   /sys/devices/virtual/block/loop3                                 
  sys-devices-virtual-block-loop4.device                                                   loaded active plugged   /sys/devices/virtual/block/loop4                                 
  sys-devices-virtual-misc-rfkill.device                                                   loaded active plugged   /sys/devices/virtual/misc/rfkill                                 
  sys-devices-virtual-tty-ttyprintk.device                                                 loaded active plugged   /sys/devices/virtual/tty/ttyprintk                               
  sys-module-fuse.device                                                                   loaded active plugged   /sys/module/fuse                                                 
  sys-subsystem-net-devices-enp0s3.device                                                  loaded active plugged   82540EM Gigabit Ethernet Controller (PRO/1000 MT Desktop Adapter)
  -.mount                                                                                  loaded active mounted   Root Mount                                                       
  dev-hugepages.mount                                                                      loaded active mounted   Huge Pages File System                                           
  dev-mqueue.mount                                                                         loaded active mounted   POSIX Message Queue File System                                  
  run-user-1000-gvfs.mount                                                                 loaded active mounted   /run/user/1000/gvfs                                              
  run-user-1000.mount                                                                      loaded active mounted   /run/user/1000                                                   
  snap-core-3887.mount                                                                     loaded active mounted   Mount unit for core                                              
  snap-core-4017.mount                                                                     loaded active mounted   Mount unit for core                                              
  snap-core-4110.mount                                                                     loaded active mounted   Mount unit for core                                              
  snap-gping-13.mount                                                                      loaded active mounted   Mount unit for gping                                             
  snap-termius\x2dapp-8.mount                                                              loaded active mounted   Mount unit for termius-app                                       
  sys-fs-fuse-connections.mount                                                            loaded active mounted   FUSE Control File System                                         
  sys-kernel-debug.mount                                                                   loaded active mounted   Debug File System                                                
  acpid.path                                                                               loaded active running   ACPI Events Check                                                
  cups.path                                                                                loaded active running   CUPS Scheduler                                                   
  systemd-ask-password-plymouth.path                                                       loaded active waiting   Forward Password Requests to Plymouth Directory Watch            
  systemd-ask-password-wall.path                                                           loaded active waiting   Forward Password Requests to Wall Directory Watch                
  init.scope                                                                               loaded active running   System and Service Manager                                       
  session-c2.scope                                                                         loaded active running   Session c2 of user magi                                          
  accounts-daemon.service                                                                  loaded active running   Accounts Service                                                 
  acpid.service                                                                            loaded active running   ACPI event daemon                                                
  anacron.service                                                                          loaded active running   Run anacron jobs                                                 
  apache2.service                                                                          loaded active running   The Apache HTTP Server                                           
  apparmor.service                                                                         loaded active exited    AppArmor initialization                                          
  apport.service                                                                           loaded active exited    LSB: automatic crash report generation                           
  aptik-battery-monitor.service                                                            loaded active running   LSB: start/stop the aptik battery monitor daemon                 
  atop.service                                                                             loaded active running   Atop advanced performance monitor                                
  atopacct.service                                                                         loaded active running   Atop process accounting daemon                                   
  avahi-daemon.service                                                                     loaded active running   Avahi mDNS/DNS-SD Stack                                          
  colord.service                                                                           loaded active running   Manage, Install and Generate Color Profiles                      
  console-setup.service                                                                    loaded active exited    Set console font and keymap                                      
  cron.service                                                                             loaded active running   Regular background program processing daemon                     
  cups-browsed.service                                                                     loaded active running   Make remote CUPS printers available locally                      
  cups.service                                                                             loaded active running   CUPS Scheduler                                                   
  dbus.service                                                                             loaded active running   D-Bus System Message Bus                                         
  postfix.service                                                                          loaded active exited    Postfix Mail Transport Agent                        
  • UNIT Describe about the corresponding systemd unit name.
  • LOAD Describes whether the corresponding unit currently loaded in memory or not.
  • ACTIVE Indicate whether the unit is active or not.
  • SUB Indicate whether the unit is in running state or not.
  • DESCRIPTION A short description about the unit.

To see loaded service in the system, use the list-units subcommand and the --type switch with a value of service. It shows active, running, exited or failed services in the output.

# systemctl list-units --type service

  UNIT                               LOAD   ACTIVE SUB     DESCRIPTION                                                      
  accounts-daemon.service            loaded active running Accounts Service                                                 
  acpid.service                      loaded active running ACPI event daemon                                                
  anacron.service                    loaded active running Run anacron jobs                                                 
  apache2.service                    loaded active running The Apache HTTP Server                                           
  apparmor.service                   loaded active exited  AppArmor initialization                                          
  apport.service                     loaded active exited  LSB: automatic crash report generation                           
  aptik-battery-monitor.service      loaded active running LSB: start/stop the aptik battery monitor daemon                 
  atop.service                       loaded active running Atop advanced performance monitor                                
  atopacct.service                   loaded active running Atop process accounting daemon                                   
  avahi-daemon.service               loaded active running Avahi mDNS/DNS-SD Stack                                          
  colord.service                     loaded active running Manage, Install and Generate Color Profiles                      
  console-setup.service              loaded active exited  Set console font and keymap                                      
  cron.service                       loaded active running Regular background program processing daemon                     
  cups-browsed.service               loaded active running Make remote CUPS printers available locally                      
  cups.service                       loaded active running CUPS Scheduler                                                   
  dbus.service                       loaded active running D-Bus System Message Bus                                         
  fwupd.service                      loaded active running Firmware update daemon                                           
  [email protected]                 loaded active running Getty on tty1                                                    
  grub-common.service                loaded active exited  LSB: Record successful boot for GRUB                             
  irqbalance.service                 loaded active running LSB: daemon to balance interrupts for SMP systems                
  keyboard-setup.service             loaded active exited  Set the console keyboard layout                                  
  kmod-static-nodes.service          loaded active exited  Create list of required static device nodes for the current kernel

Run the following command to view a particular service status.

# systemctl | grep apache2

  apache2.service                                                                          loaded active running   The Apache HTTP Server

Detailed information about a particular service can be verified with the systemctl command as shown below.

# systemctl status apache2

● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/apache2.service.d
           └─apache2-systemd.conf
   Active: active (running) since Tue 2018-03-06 12:34:09 IST; 8min ago
  Process: 2786 ExecReload=/usr/sbin/apachectl graceful (code=exited, status=0/SUCCESS)
 Main PID: 1171 (apache2)
    Tasks: 55 (limit: 4915)
   CGroup: /system.slice/apache2.service
           ├─1171 /usr/sbin/apache2 -k start
           ├─2790 /usr/sbin/apache2 -k start
           └─2791 /usr/sbin/apache2 -k start

Mar 06 12:34:08 magi-VirtualBox systemd[1]: Starting The Apache HTTP Server...
Mar 06 12:34:09 magi-VirtualBox apachectl[1089]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.0.2.15. Set the 'ServerName' directive globally to suppre
Mar 06 12:34:09 magi-VirtualBox systemd[1]: Started The Apache HTTP Server.
Mar 06 12:39:10 magi-VirtualBox systemd[1]: Reloading The Apache HTTP Server.
Mar 06 12:39:10 magi-VirtualBox apachectl[2786]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using fe80::7929:4ed1:279f:4d65. Set the 'ServerName' directive gl
Mar 06 12:39:10 magi-VirtualBox systemd[1]: Reloaded The Apache HTTP Server.

Run the following command to view the services running on the system with the systemctl command:

# systemctl list-units --type=service --state=running
or
# systemctl | grep running

  acpid.path                                                                               loaded active running   ACPI Events Check                                                
  cups.path                                                                                loaded active running   CUPS Scheduler                                                   
  init.scope                                                                               loaded active running   System and Service Manager                                       
  session-c2.scope                                                                         loaded active running   Session c2 of user magi                                          
  accounts-daemon.service                                                                  loaded active running   Accounts Service                                                 
  acpid.service                                                                            loaded active running   ACPI event daemon                                                
  apache2.service                                                                          loaded active running   The Apache HTTP Server                                           
  aptik-battery-monitor.service                                                            loaded active running   LSB: start/stop the aptik battery monitor daemon                 
  atop.service                                                                             loaded active running   Atop advanced performance monitor                                
  atopacct.service                                                                         loaded active running   Atop process accounting daemon                                   
  avahi-daemon.service                                                                     loaded active running   Avahi mDNS/DNS-SD Stack                                          
  colord.service                                                                           loaded active running   Manage, Install and Generate Color Profiles                      
  cron.service                                                                             loaded active running   Regular background program processing daemon                     
  cups-browsed.service                                                                     loaded active running   Make remote CUPS printers available locally                      
  cups.service                                                                             loaded active running   CUPS Scheduler                                                   
  dbus.service                                                                             loaded active running   D-Bus System Message Bus                                         
  fwupd.service                                                                            loaded active running   Firmware update daemon                                           
  [email protected]                                                                       loaded active running   Getty on tty1                                                    
  irqbalance.service                                                                       loaded active running   LSB: daemon to balance interrupts for SMP systems                
  lightdm.service                                                                          loaded active running   Light Display Manager                                            
  ModemManager.service                                                                     loaded active running   Modem Manager                                                    
  NetworkManager.service                                                                   loaded active running   Network Manager                                                  
  polkit.service                                                                           loaded active running   Authorization Manager                                 

Use the below command to see which services were enabled on boot:

# systemctl list-unit-files --state=enabled

acpid.path                                 enabled 
cups.path                                  enabled 
accounts-daemon.service                    enabled 
anacron-resume.service                     enabled 
anacron.service                            enabled 
apache2.service                            enabled 
apparmor.service                           enabled 
atop.service                               enabled 
atopacct.service                           enabled 
[email protected]                            enabled 
avahi-daemon.service                       enabled 
bluetooth.service                          enabled 
console-setup.service                      enabled 
cron.service                               enabled 
cups-browsed.service                       enabled 
cups.service                               enabled 
display-manager.service                    enabled 
dns-clean.service                          enabled 
friendly-recovery.service                  enabled 
[email protected]                             enabled 
gpu-manager.service                        enabled 
keyboard-setup.service                     enabled 
lightdm.service                            enabled 
ModemManager.service                       enabled 
network-manager.service                    enabled 
networking.service                         enabled 
NetworkManager-dispatcher.service          enabled 
NetworkManager-wait-online.service         enabled 
NetworkManager.service                     enabled 

systemd-cgtop shows top control groups by their resource usage such as tasks, CPU, Memory, Input, and Output:

# systemd-cgtop

Control Group                                              Tasks   %CPU   Memory  Input/s Output/s
/                                                              -      -     1.5G        -        -
/init.scope                                                    1      -        -        -        -
/system.slice                                                153      -        -        -        -
/system.slice/ModemManager.service                             3      -        -        -        -
/system.slice/NetworkManager.service                           4      -        -        -        -
/system.slice/accounts-daemon.service                          3      -        -        -        -
/system.slice/acpid.service                                    1      -        -        -        -
/system.slice/apache2.service                                 55      -        -        -        -
/system.slice/aptik-battery-monitor.service                    1      -        -        -        -
/system.slice/atop.service                                     1      -        -        -        -
/system.slice/atopacct.service                                 1      -        -        -        -
/system.slice/avahi-daemon.service                             2      -        -        -        -
/system.slice/colord.service                                   3      -        -        -        -
/system.slice/cron.service                                     1      -        -        -        -
/system.slice/cups-browsed.service                             3      -        -        -        -
/system.slice/cups.service                                     2      -        -        -        -
/system.slice/dbus.service                                     6      -        -        -        -
/system.slice/fwupd.service                                    5      -        -        -        -
/system.slice/irqbalance.service                               1      -        -        -        -
/system.slice/lightdm.service                                  7      -        -        -        -
/system.slice/polkit.service                                   3      -        -        -        -
/system.slice/repowerd.service                                14      -        -        -        -
/system.slice/rsyslog.service                                  4      -        -        -        -
/system.slice/rtkit-daemon.service                             3      -        -        -        -
/system.slice/snapd.service                                    8      -        -        -        -
/system.slice/system-getty.slice                               1      -        -        -        -

Method-2(a): Listing Linux services with pstree command

List of services running in a Linux system can be verified using the ‘pstree’ command as shown below.

# pstree

systemd─┬─ModemManager─┬─{gdbus}
        │              └─{gmain}
        ├─NetworkManager─┬─dhclient
        │                ├─{gdbus}
        │                └─{gmain}
        ├─accounts-daemon─┬─{gdbus}
        │                 └─{gmain}
        ├─acpid
        ├─agetty
        ├─anacron
        ├─apache2───2*[apache2───26*[{apache2}]]
        ├─aptd───{gmain}
        ├─aptik-battery-m
        ├─atop
        ├─atopacctd
        ├─avahi-daemon───avahi-daemon
        ├─colord─┬─{gdbus}
        │        └─{gmain}
        ├─cron
        ├─cups-browsed─┬─{gdbus}
        │              └─{gmain}
        ├─cupsd
        ├─dbus-daemon
        ├─fwupd─┬─{GUsbEventThread}
        │       ├─{fwupd}
        │       ├─{gdbus}
        │       └─{gmain}
        ├─gnome-keyring-d─┬─{gdbus}
        │                 ├─{gmain}
        │                 └─{timer}

Method-2(b): Listing Linux Services with chkservice command

chkservice is a new tool for managing systemd units in terminal. It requires super user privileges to manage the units.

# chkservice

To view the help page, hit '?' button. This will show you available options to manage the systemd services.

Conclusion

This article explained several ways to check and list all running Linux services.

If you have any questions or feedback, feel free to comment below.


About Magesh Maruthamuthu

Love to play with all Linux distribution

View all posts by Magesh Maruthamuthu

5 Comments on “How to check all running services in Linux”

  1. Thanks for your valuable information.
    I also want to know if there is any command to see any vulnerable / risk services running.
    What is the command used to check vulnerable / risk or any negative services running..
    Thanks in advance.

Leave a Reply

Your email address will not be published. Required fields are marked *