Active But Not Running: Decoding Active (Exited) in systemctl

In the output of the systemctl status command, “active (exited)” indicates the current state of a systemd service.

Let’s break down what “active (exited)” means:

• Active: This part of the status indicates the current operational state of the unit. In this case, “active” means that the unit is currently running or has completed its execution. It’s in an operational state, not in a inactive state.
• Exited: This part of the status provides additional information about the unit’s state. “Exited” means that the unit has completed its execution and has terminated or exited. This is a common state for services that run a specific task or job and then finish, such as starting a web server or executing a one-time script.

Here’s an example of what the status might look like in the output of systemctl status:

● myservice.service – My Custom Service
Loaded: loaded (/etc/systemd/system/myservice.service; enabled; vendor preset: enabled)
Active: active (exited) since Sat 2023-09-09 10:00:00 CEST; 1h 30min ago
Process: 12345 ExecStart=/usr/bin/myprogram (code=exited, status=0/SUCCESS)
Main PID: 12345 (code=exited, status=0/SUCCESS)

In this example, “myservice.service” is currently active but has exited. It started and successfully completed its task, as indicated by “status=0/SUCCESS.”

The service is no longer running but has done its job and is now in an “exited” state. This status is common for services that are designed to perform specific tasks and then terminate.

Example of active and exited service in Linux

In Linux, iptables is not a standalone service but rather a powerful firewall management tool that is integrated into the Linux kernel. It allows you to configure and manage firewall rules for controlling incoming and outgoing network traffic.

Iptables operates at the kernel level, which means it can efficiently filter packets before they reach the network stack or leave the system.

# systemctl status iptables
● iptables.service – IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Mon 2023-09-11 13:20:10 GMT; 4s ago
Process: 1802474 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
Process: 1985002 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
Main PID: 1985002 (code=exited, status=0/SUCCESS)

From the output, we can see that iptables service is in active and exited status.

The firewall rules themselves remain in effect even when the service is exited.

You can use iptables command to confirm the status. You can list the current rules and policy settings for each chain in the filter table (which is the default for iptables) with the following command:

sudo iptables -L

If you want to see the rules for a specific chain (e.g., INPUT), you can specify it like this:

sudo iptables -L INPUT

This will display the current rules, counters, and policies for the specified chain.

Let’s see another example.

ABRT is a tool that automatically detects and collects information about system and application crashes. When a crash occurs, ABRT collects diagnostic data and can optionally report it to the system administrator or a bug tracking system.

The “active (exited)” status is normal for ABRT because it is designed to run as needed when crashes occur. Once it has completed its tasks for a crash event, it exits until another crash event triggers its operation.

This status indicates that ABRT is available to monitor and handle crash events when they occur but is not continuously running as a background service.