ssh_service_status
Determine if a systemd service is running or failing by checking its load, active, and enabled state and reading recent journal entries.
Instructions
Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal. A machine without systemd comes back as NOT CHECKED, never as a stopped service — that would read as an outage which is not there. For every failed unit at once, ssh_audit_baseline names them.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false Without it the journal comes back trimmed to what the profile user may see. | |
| unit | Yes | Unit name, e.g. "nginx" or "nginx.service". | |
| since | No | Journal window, as journalctl reads it: "1h ago", "today", "2026-08-19". | |
| profile | Yes | Machine name. | |
| log_lines | No | Journal lines returned. Default: 50 |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| unit | No | ||
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. | |
| enabled | No | ||
| outcome | No | checked — systemd answered, and the fields below carry its measurement; no_systemd — there was nobody to ask on this server, so the service was not measured; no_unit — systemd knows no such unit, which is not the same as a unit that is stopped. | |
| restart | No | ||
| sub_state | No | ||
| recent_log | No | ||
| status_head | No | ||
| active_state | No | ||
| restart_after | No |