# Systemd Unit Inspector

Paste a systemd unit file (.service, .timer or .socket) to see its settings by section, such as \[Unit\], \[Service\] and \[Install\], with the meaning of each setting. It flags with line numbers an ExecStart placed in \[Unit\], a program path that is not absolute, a service with no User that runs as root, and a missing WantedBy that prevents enable. You can also make a starter unit.

- URL: https://tools.itlibra.com/en/systemd-unit-inspector
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Paste the contents of a unit file, or drop the file. “Try a sample” shows how it works.
2. In “Settings”, check each section and the meaning of each setting. Hardening suggestions are listed here too.
3. Open “Issues” for the list by severity. Misspelled ExecStart and root-run services are high or medium; the rest are low.
4. In “Make a template”, create a unit for a web app or a scheduled job. Fill in the user, paths and time, then save it.
5. After you change a unit, run systemctl daemon-reload, then restart the service.

## Use cases

- Check where ExecStart goes and whether the User setting is right for a new web app service
- Replace a cron job with a systemd timer and get the .timer and .service shapes right
- See which hardening settings such as NoNewPrivileges and ProtectSystem an existing root service lacks
- Find out why a service keeps restarting, including StartLimit settings that remove the limit

## What it does

### Settings and meanings by section

Shows the settings and values of \[Unit\], \[Service\], \[Install\], \[Timer\] and \[Socket\] in tables, with a short meaning for each. Names not in the list are shown as unknown.

### Misplaced keys and typos

Flags settings that have no effect in their section, such as ExecStart under \[Unit\]. For a spelling difference such as Restartsec, it also suggests the correct name.

### Startup form checks

Flags Type and ExecStart combinations (several ExecStart lines unless oneshot), program paths that are not absolute, services without User, and an \[Install\] without WantedBy.

### Restart checks

Checks combinations of Restart and RestartSec, and whether StartLimitIntervalSec=0 has removed the restart limit.

### Hardening suggestions and starter templates

Lists the hardening settings that are not set, such as NoNewPrivileges, ProtectSystem, ProtectHome and PrivateTmp. Makes a starter for a web app or a scheduled job (timer).


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading .service, .timer and .socket files and showing their settings | Supported | — |
| Misplaced sections and typos (for setting names in the list) | Supported | — |
| Basic checks of Type, ExecStart, User, WantedBy and Restart | Supported | — |
| Whether the hardening settings are present (11 items in the list) | Partial | Only checks whether each setting is present. Effects and compatibility are not checked |
| Starter templates (web app, scheduled job) | Supported | — |
| A replacement for systemd-analyze verify or security | Not supported | It is not a replacement. Program existence, permissions and dependencies are not checked |
| Installing, starting or enabling units; running systemctl | Not supported | Not run. No network requests are made |
| Drop-in (.d) directories and template (@) expansion | Not supported | Not expanded. Only the one file you paste is read |

## Limits & notes

- Input is limited to 100,000 characters and 2,000 lines. Anything beyond is not read, and you are told.
- Only setting names in the list are checked. Some valid settings may be shown as unknown.
- Hardening suggestions only show whether a setting is present. They change behavior, so test them before you enable them.
- Findings follow the systemd man pages. Defaults and setting names can differ between systemd versions.

## Privacy & safety

Pasted unit files are processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### What is the minimum a service needs?

Write ExecStart with an absolute path in \[Service\], and WantedBy=multi-user.target in \[Install\]. Then systemctl enable can enable it. Without User, the service runs as root, so set a dedicated user.

### My change to a unit does not take effect.

Run systemctl daemon-reload, then restart the service. Without daemon-reload, systemd keeps running the old definition.

### How do Restart=always and StartLimit work together?

Restart restarts the service after each exit. By default, the number of starts in a period is limited, so a broken service usually does not restart forever. StartLimitIntervalSec=0 removes that limit.

### Should I use cron or a systemd timer?

Either can run jobs on a schedule. Timers fit well with dependencies and the journal, and Persistent=true runs missed calendar runs. Choose for your use.

### Can I add the hardening settings as they are?

Not without testing. ProtectSystem and MemoryDenyWriteExecute change which paths can be written and how JIT code runs. Try them in a staging environment first.