Chapter 5: System Administration Essentials

Updated

October 31, 2026

Chapter 5: System Administration Essentials

Systems administration on modern Linux requires configuring service lifecycles, resource controls, declarative networking, storage pools, accurate time synchronization, and performance profiling.

In Ubuntu 26.04 LTS, these operational responsibilities center around systemd 259, unified cgroups v2, Netplan 1.2, Chrony NTP, and the system-wide Sysprof profiler.

This chapter provides a guide to administrating an Ubuntu 26.04 host in production.

User and Group Management

Managing local user accounts, groups, and login shells is handled via standard shadow utilities:

# Create a new user with home directory and bash shell
sudo adduser --gecos "DevOps Engineer" alice

# Create a system service account without login shell
sudo adduser --system --no-create-home --group prometheus

# Add existing user to privileged groups (sudo and docker)
sudo usermod -aG sudo,docker alice

# Lock and unlock user accounts
sudo usermod -L bad_actor   # Lock account (prepends ! to password hash)
sudo usermod -U bad_actor   # Unlock account

# Inspect user identity and supplementary group memberships
id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo),998(docker)

systemd 259: Services, Units, and cgroup v2

Ubuntu 26.04 LTS is powered by systemd 259, which manages daemon lifecycles, timer events, network mounts, and resource isolation via unified cgroups v2.

┌────────────────────────────────────────────────────────────────────────┐
│                   SYSTEMD 259 ARCHITECTURE & CGROUPS V2                │
│                                                                        │
│                      systemd (PID 1)                                   │
│                            │                                           │
│       ┌────────────────────┼────────────────────┐                      │
│       ▼                    ▼                    ▼                      │
│  system.slice         user.slice           machine.slice               │
│  (System Services)    (User Sessions)      (Containers / VMs)          │
│       │                    │                    │                      │
│       ▼                    ▼                    ▼                      │
│  nginx.service        user@1000.service    libvirt-guest.scope         │
│  [CPUWeight=100]      [MemoryMax=4G]       [CPUQuota=200%]             │
└────────────────────────────────────────────────────────────────────────┘

Essential systemctl Operations

# Service Lifecycle Control
sudo systemctl start nginx.service
sudo systemctl stop nginx.service
sudo systemctl restart nginx.service
sudo systemctl reload nginx.service   # Graceful config reload

# Boot Startup Enablement
sudo systemctl enable nginx.service
sudo systemctl disable nginx.service
sudo systemctl is-active nginx.service
sudo systemctl is-failed nginx.service

Creating a Hardened Custom Service Unit

Store custom units under /etc/systemd/system/:

# /etc/systemd/system/my-api.service
[Unit]
Description=Production Golang API Service
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
User=apiuser
Group=apiuser
WorkingDirectory=/opt/my-api
ExecStart=/opt/my-api/bin/api-server --config=/etc/my-api/config.yaml
Restart=on-failure
RestartSec=5s

# Security Hardening & cgroup v2 Resource Limits
MemoryMax=2G
CPUQuota=150%
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/log/my-api
PrivateTmp=yes
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

Reload systemd and start the new unit:

sudo systemctl daemon-reload
sudo systemctl enable --now my-api.service

Logging and Log Analysis with journalctl

All system, kernel, and container logs are unified within the binary systemd-journald store:

# View real-time logs for a specific unit
sudo journalctl -u nginx.service -f

# Filter logs since last boot
sudo journalctl -b

# Filter logs by priority (err, warning, info)
sudo journalctl -p err..emerg

# Filter logs within a specific time window
sudo journalctl --since "2026-10-30 08:00:00" --until "2026-10-30 12:00:00"

# Check journal disk consumption and vacuum old archives
journalctl --disk-usage
sudo journalctl --vacuum-size=500M

Scheduled Tasks: Cron and Systemd Timers

While traditional /etc/cron.* scripts remain supported, modern scheduled tasks should leverage systemd timers for dependency awareness and execution logs.

# /etc/systemd/system/backup.timer
[Unit]
Description=Daily Database Backup Timer

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
RandomizedDelaySec=15m

[Install]
WantedBy=timers.target

Enable the timer:

sudo systemctl enable --now backup.timer
systemctl list-timers

Network Configuration with Netplan 1.2

In Ubuntu 26.04 LTS, all network interfaces are declared via Netplan 1.2 YAML specifications in /etc/netplan/:

# /etc/netplan/50-cloud-init.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    enp3s0:
      dhcp4: false
      addresses:
        - 192.168.10.50/24
      routes:
        - to: default
          via: 192.168.10.1
      nameservers:
        addresses:
          - 1.1.1.1
          - 8.8.8.8
        search:
          - corp.local

Test and apply network configurations safely:

# Validate syntax and test configuration with automatic rollback
sudo netplan try

# Apply configuration permanently
sudo netplan apply

# Inspect active interface status
netplan status

Accurate Time Synchronization with Chrony NTP

Accurate timekeeping is critical for database transactions, TLS certificate validity, and Kerberos tickets:

# Verify chrony service status
sudo systemctl status chrony

# Query active NTP upstream servers and time offsets
chronyc sources -v

# Check clock tracking synchronization performance
chronyc tracking

Expected output:

Reference ID    : 198.51.100.12 (time.cloudflare.com)
Stratum         : 2
Ref time (UTC)  : Fri Oct 30 10:15:22 2026
System time     : 0.000012480 seconds fast of NTP time
Last offset     : +0.000008412 seconds
RMS offset      : 0.000014209 seconds
Frequency       : 12.490 ppm slow

Storage Management: LVM and Disk Partitions

Logical Volume Manager (LVM) enables dynamic volume resizing without downtime:

# 1. Create Physical Volume (PV) on raw disk
sudo pvcreate /dev/nvme1n1

# 2. Create Volume Group (VG) named 'vg_data'
sudo vgcreate vg_data /dev/nvme1n1

# 3. Create a 50 GB Logical Volume (LV) named 'lv_db'
sudo lvcreate -L 50G -n lv_db vg_data

# 4. Format with ext4 filesystem
sudo mkfs.ext4 /dev/vg_data/lv_db

# 5. Mount persistently via /etc/fstab
echo "/dev/vg_data/lv_db /var/lib/postgresql ext4 defaults 0 2" | sudo tee -a /etc/fstab
sudo mount -a

# 6. Dynamically expand volume by 20 GB online
sudo lvextend -L +20G /dev/vg_data/lv_db -r

System Monitoring and Profiling with Sysprof

Ubuntu 26.04 features Sysprof for full-system, low-overhead performance profiling:

# CLI profiling: capture 10 seconds of system-wide CPU and memory activity
sudo sysprof-cli --duration=10 --force -o profile.syscap

# Inspect top resource consumers in terminal
sysprof-cli --dump profile.syscap | head -n 25

Chapter Summary

  • User and group administration provides role-based access control and isolated service identities.
  • systemd 259 unifies process supervision, cgroups v2 resource quotas, and security boundaries.
  • journalctl provides indexed, structured log searching across boots, units, and priority levels.
  • Netplan 1.2 provides a declarative YAML framework for configuring network interfaces, bridges, and VLANs.
  • Chrony ensures sub-millisecond clock synchronization essential for distributed consensus.
  • LVM allows online storage expansion, while Sysprof delivers system-wide performance profiling.