- Alright, so the first thing I wanna talk about
in this lesson about advanced systemd features,
is how to modify systemd units.
So, you can edit systemd units.
If you want to know what you can put in there,
start by using systemctl show on the unit,
and that'll show you all the different unit parameters.
And once you've decided what you want to edit,
you can change the settings using
systemctl edit unit.type,
where unit.type is the name of your unit.
So that can be sshd.service or whatever you want.
And after saving changes,
you might want to do systemctl daemon-reload
to update systemd and ensure that systemd knows
about all the most recent changes.
But in many cases,
that's not even required anymore nowadays.
And next, use systemctl restart unit
to restart the unit with new settings.
If you don't like the default editor,
you can also use the EDITOR or SYSTEMD_EDITOR variable
to change the default editor.
Let's go check this out.
So if you want to edit, it's a good start to use
systemctl show on the unit that you want to edit.
sshd.service, for instance.
And there you see all the different parameters
that can be set.
And let's just pick out a random parameter.
Delegate=no.
You might be wondering,
what is this Delegate=no all about?
Well, in order to figure that out,
use man on systemd.directives.
systemd.directives is a very useful man page,
because all the different directives that you can use
in all of your systemd unit files are documented in here.
So let's look up Delegate.
And there we can see
that Delegate is in systemd.resource-control,
which is another man page.
So, man systemd.resource-control,
and there we are going to look up Delegate.
And there we can see the explanation
for the delegation parameter.
I don't wanna read everything that we have right here.
I just want to show you,
if you find any parameter that requires more information,
this is how you do it.
man systemd.directives,
it's the most important thing to do.
Good.
Now, once you have decided that you want to edit a unit,
then you use systemctl edit.
But wouldn't it make sense before editing,
to show what's inside?
So systemctl cat
sshd.service
is showing the current configuration.
And in this current configuration you can see
all the different parameters that currently apply.
And you know what?
I want to apply memory limitations.
So let's get back
to systemctl show.
And in systemctl show, didn't we have anything like memory?
And there we go.
We have
MemoryMax.
MemoryMax=infinity.
I don't wanna set infinity.
I want to set MemoryMax to 4 megabytes,
or something like that.
How do we get there?
Well, man systemd.directives,
MemoryMax, or just memory.
That's a lot of memory related parameters.
There we go.
MemoryMax.
And that is in systemd.resource-control.
So, back to resource-control,
and let's look at MemoryMax.
And,
there we go.
MemoryMax is, and there we can see the value in bytes, or,
and this is what I was looking for,
suffixed by K or M or G or T.
Well that's perfect.
I want it to be suffixed by M for megabytes.
So now we can get back.
And finally we can use systemctl edit
sshd.service.
And here we have the default editor.
Hoo, that is nano.
I don't like nano as a default editor,
but for now I'll deal with it,
because I wanna focus on this MemoryMax,
which is a parameter of the service.
So I am going to put the modification at the location
where the editor is indicating.
So MemoryMax=4M.
4 megabytes should be more than enough for SSH.
Now that I've made my change, I can use Control + X.
And save modified buffer? Yes.
And I'm pressing Enter to create the override file.
Now what is going on when you use systemctl edit?
Well, that is what we will find if we use
systemctl cat again on sshd.service.
Let me put that on top of the screen for better readability.
Here we can see the default configuration
from /usr/lib/systemd/system/sshd.service.
And what is happening?
Well, when you use systemctl edit,
you create an override file.
And the override file is in
/etc/systemd/system/sshd.service.d
in this case.
And you know what?
They are both going to be merged.
So at this point, my sshd.service
has a maximum memory setting of 4 megabytes.
If you really want to do it decently,
you should consider daemon-reload and restart unit.type.
Is it necessary?
Let's figure it out.
systemctl status on sshd.service
And what do we see?
Well, we see that by using systemctl edit
on modern versions of systemd,
you don't have to restart anything.
It is automatically picked up.
And at this moment,
my sshd process cannot go beyond 4 megabytes.
And that is how you can apply
the so-called cgroups on systemd.
More about cgroups later.
But there is one thing that I want to fix right now.
And that is export
EDITOR=/usr/bin/vim.
And now if we do the edit thing again,
there we have a real editor.
That's a matter of taste.
You are allowed to disagree.
And if you want to do your edits with nano,
that's perfectly fine.