Linux System Administration — Users, Services, and Monitoring

Linux system administration covers the day-to-day tasks of managing users, services, scheduled tasks, and system health monitoring. Whether you’re running a single Raspberry Pi or a data center, these skills keep your systems running reliably.

What You’ll Learn

By the end of this tutorial, you’ll know how to create and manage users and groups, control services with systemd, view logs with journalctl, schedule tasks with cron, and monitor system resources using top, htop, df, free, and related tools.

Why System Administration Matters

A well-administered system is reliable, secure, and maintainable. User management ensures the right people have the right access. Service management keeps applications running. Monitoring catches problems before they become outages. At DodaTech, DodaZIP and Durga Antivirus Pro depend on automated monitoring and service management to process millions of requests without downtime.

System Administration Learning Path

    flowchart LR
  A[Linux Basics] --> B[Server Setup]
  B --> C[Essential Commands]
  C --> D[System Administration]
  D --> E[Package Management]
  D --> F{You Are Here}
  style F fill:#f90,color:#fff
  

User and Group Management

Every process on Linux runs as a specific user. Managing users and groups is fundamental to system security and organization.

# Creating and managing users
sudo useradd -m -s /bin/bash jane     # Create user with home directory
sudo passwd jane                      # Set password
sudo usermod -aG sudo jane            # Add to sudo group
sudo userdel -r jane                  # Delete user and home directory

# Group management
sudo groupadd developers              # Create a new group
sudo usermod -aG developers alice     # Add user to group
groups alice                          # Show user's groups
sudo groupdel developers              # Delete group

Checking user info:

# View user details
id jane

Expected output:

uid=1002(jane) gid=1002(jane) groups=1002(jane),27(sudo)

# List logged-in users
who

# Show login history
last

Managing systemd Services

systemd is the init system used by virtually all modern Linux distributions. It manages services, timers, mounts, and more.

# Service lifecycle
sudo systemctl status nginx            # Check service status
sudo systemctl start nginx             # Start a service
sudo systemctl stop nginx              # Stop a service
sudo systemctl restart nginx           # Restart
sudo systemctl reload nginx            # Reload config without stopping
sudo systemctl enable nginx            # Start on boot
sudo systemctl disable nginx           # Don't start on boot
sudo systemctl enable --now nginx      # Enable and start immediately

Expected output for systemctl status nginx:

● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Sun 2026-06-07 10:00:00 UTC
   Main PID: 1234 (nginx)
      Tasks: 3 (limit: 2327)
     Memory: 5.2M
        CPU: 50ms
     CGroup: /system.slice/nginx.service
             ├─1234 "nginx: master process /usr/sbin/nginx"
             └─1235 "nginx: worker process"

Creating a Custom Systemd Service

Here’s how to create a service for a custom Python application:

# /etc/systemd/system/myapp.service
[Unit]
Description=My Python Application
After=network.target

[Service]
Type=simple
User=myapp
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/python3 /opt/myapp/app.py
Restart=on-failure
RestartSec=5
Environment=PYTHONUNBUFFERED=1

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload       # Reload service files
sudo systemctl enable --now myapp  # Start myapp service
sudo journalctl -u myapp -f        # Watch its logs

Journalctl — Centralized Logging

systemd-journald collects and manages logs from the kernel, services, and applications.

# View all logs
journalctl

# Follow new log entries (like tail -f)
journalctl -f

# Filter by service
journalctl -u nginx
journalctl -u ssh.service

# Time-based filtering
journalctl --since "2026-06-01" --until "2026-06-07"
journalctl --since "1 hour ago"

# By priority
journalctl -p err                    # Errors and above
journalctl -p warning                # Warnings and above

# Kernel messages
journalctl -k

# JSON output
journalctl -u nginx -o json-pretty

Cron Jobs — Scheduled Tasks

Cron runs commands at scheduled times. This is how you automate backups, log rotation, and maintenance tasks.

# Edit crontab for current user
crontab -e

# Edit crontab for a specific user
sudo crontab -u jane -e

# List cron jobs
crontab -l

Crontab syntax:

# ┌──────── minute (0-59)
# │ ┌──────── hour (0-23)
# │ │ ┌──────── day of month (1-31)
# │ │ │ ┌──────── month (1-12)
# │ │ │ │ ┌──────── day of week (0-7, 0=Sun)
# * * * * * command to execute

Common cron patterns:

# Every day at 2:30 AM — backup database
30 2 * * * /usr/local/bin/backup-db.sh

# Every hour — check disk space
0 * * * * /usr/local/bin/check-disk.sh

# Every Monday at 3 AM — update system packages
0 3 * * 1 apt update && apt upgrade -y

# Reboot — run a startup script
@reboot /usr/local/bin/start-custom-services.sh

# Every 5 minutes — check service health
*/5 * * * * /usr/local/bin/health-check.sh

Expected output from crontab -l:

# Edit this file to introduce tasks to be run by cron.
#
# m h  dom mon dow   command
30 2 * * * /usr/local/bin/backup-db.sh
0 * * * * /usr/local/bin/check-disk.sh
@reboot /usr/local/bin/start-custom-services.sh

System Monitoring

Proactive monitoring prevents outages. Here are the essential commands:

# Real-time process monitoring
top                          # Default process viewer (press q to quit)
htop                         # Enhanced viewer (install via apt)

# Disk usage
df -h                        # Filesystem disk usage
du -sh /var/log              # Directory size
du -h --max-depth=1 /home    # Top-level home dir sizes

# Memory
free -h                      # RAM and swap usage
cat /proc/meminfo            # Detailed memory info

# Load average and uptime
uptime                       # Load average (1, 5, 15 minutes)

# I/O stats
iostat -xz 1                 # Disk I/O (install sysstat)
iotop                        # Per-process I/O (sudo required)

Expected output from free -h:

               total        used        free      shared  buff/cache   available
Mem:            15Gi       3.2Gi       8.5Gi       245Mi       3.3Gi        11Gi
Swap:          2.0Gi        0.0Ki       2.0Gi

Expected output from uptime:

 14:30:00 up 45 days,  3:15,  2 users,  load average: 0.15, 0.20, 0.18

Log File Management

Logs can grow quickly and fill your disk. Manage them with logrotate:

# /etc/logrotate.d/custom-app
/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 640 myapp myapp
    postrotate
        systemctl reload myapp
    endscript
}

Common System Administration Mistakes

1. Not Locking User Accounts After Departure

When someone leaves, disable their account immediately: sudo usermod -L username. A disabled account cannot log in. Delete only after verifying no critical processes run under that user.

2. Forgetting systemctl daemon-reload

After creating or modifying a systemd service file, you must run sudo systemctl daemon-reload before systemd recognizes the changes.

3. Using kill -9 on systemd Services

systemctl stop service is the proper way. kill -9 on a PID managed by systemd can leave the service in a bad state. Use systemctl kill if necessary.

4. Not Setting Log Rotation

Without logrotate, log files grow until they fill the disk. A full /var partition can crash services and prevent logins. Always configure log rotation.

5. Ignoring Load Average Spikes

A load average above the CPU core count means processes are waiting. Investigate before it causes slowdowns or timeouts. Use top or htop to find the culprits.

6. Running Cron Jobs as Root Without Thought

Cron jobs run with the privileges of their owner. A root cron job with a bug can destroy the system. Run cron jobs as the least privileged user needed.

7. Not Testing Cron Job Output

Cron sends output via email by default. If mail isn’t configured, output is lost. Redirect to a log file: */5 * * * * /script.sh >> /var/log/script.log 2>&1.

Practice Questions

1. How do you make a service start automatically on boot?

Use sudo systemctl enable servicename. To do it in one step: sudo systemctl enable --now servicename which also starts it immediately.

2. What’s the difference between useradd and adduser on Debian/Ubuntu?

useradd is the low-level binary. adduser is a Perl script that calls useradd interactively, creating the home directory and prompting for a password. On Debian, use adduser for simplicity.

3. What does journalctl -u ssh -p err --since "1 hour ago" do?

It shows error-level and above log entries from the SSH service within the last hour.

4. Write a cron job that runs /backup.sh every Sunday at midnight.

0 0 * * 0 /backup.sh (Sunday is 0 in cron’s day-of-week field).

5. Challenge: Create a script that checks if a service is running and restarts it if it’s not, logging the action to /var/log/service-watchdog.log.

Answer:

#!/bin/bash
service="nginx"
if ! systemctl is-active --quiet "$service"; then
    systemctl restart "$service"
    echo "$(date): Restarted $service" >> /var/log/service-watchdog.log
fi

Mini Project: System Health Dashboard Script

Create a script that provides a comprehensive system health overview:

#!/bin/bash
# health_dashboard.sh — Display system health summary

echo "╔══════════════════════════════════════╗"
echo "║        System Health Dashboard       ║"
echo "╚══════════════════════════════════════╝"
echo ""

# Uptime and load
echo "── Uptime & Load ──"
uptime
echo ""

# CPU
echo "── CPU ──"
echo "Cores: $(nproc)"
echo "Load: $(cat /proc/loadavg | awk '{print $1", "$2", "$3}')"
echo ""

# Memory
echo "── Memory ──"
free -h | awk 'NR==1 || NR==2'
echo ""

# Disk
echo "── Disk Usage ──"
df -h | grep -E '^/dev/|Filesystem'
echo ""

# Top processes by memory
echo "── Top 5 Processes (by memory) ──"
ps aux --sort=-%mem | head -6
echo ""

# Listening services
echo "── Listening Services ──"
ss -tuln | tail -n +2
echo ""

# Failed services check
echo "── Failed Services ──"
systemctl --failed --no-legend 2>/dev/null | awk '{print $1, $2}' || echo "None"

Save as health_dashboard.sh, make it executable, and run it with ./health_dashboard.sh.

Expected output (abbreviated):

╔══════════════════════════════════════╗
║        System Health Dashboard       ║
╚══════════════════════════════════════╝

── Uptime & Load ──
 14:30:00 up 45 days,  3:15,  2 users,  load average: 0.10, 0.15, 0.12

── CPU ──
Cores: 4
Load: 0.10, 0.15, 0.12

── Memory ──
               total        used        free      shared  buff/cache   available
Mem:            15Gi       3.1Gi       8.6Gi       245Mi       3.2Gi        11Gi

── Disk Usage ──
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       234G   45G  189G  20% /

── Top 5 Processes (by memory) ──
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     1234  0.5  8.2 1.2G 1.2G ?        Ssl  May15  45:20 /usr/sbin/mysqld
...

FAQ

What’s Next

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.