Unit 9: Scheduled tasks and persistence · Lesson 3 of 6 · 14 min

systemd timers

The modern replacement for cron: read when a timer fires and which service it starts.

mission

You are
You are completing the schedule inventory.
Situation
Not every scheduled job lives in cron. systemd timers start services on a calendar.
Goal
Find the custom timer and what it runs.
Hand in
The time of the nightly backup and its command.

A timer and its service

  1. backup.timerOnCalendar=02:30
  2. backup.serviceUser and ExecStart
  3. The scriptWhat really runs
01

List enabled timers

learner@root-lab
ls /etc/systemd/system/timers.target.wants/
apt-daily-upgrade.timer
apt-daily.timer
backup.timer
dpkg-db-backup.timer
e2scrub_all.timer
fstrim.timer
motd-news.timer

you should see One custom timer among the package ones.

02

Read the timer and its service

A timer starts the service with the same name unless it says otherwise.

learner@root-lab
grep -E '^(OnCalendar|Persistent)' /etc/systemd/system/backup.timer
OnCalendar=*-*-* 02:30:00
Persistent=true
grep -E '^(User|ExecStart)' /etc/systemd/system/backup.service
User=root
ExecStart=/opt/scripts/report.sh

you should see Every night at 02:30 as root. Persistent means a missed run happens at the next boot.

defender tip On a running host, systemctl list-timers shows the last and next run of each.

03

List every timer and its state

This works even without systemd running, because it reads the unit files.

learner@root-lab
systemctl list-unit-files --type=timer --no-pager | head -n 9
UNIT FILE                      STATE    PRESET
apt-daily-upgrade.timer        enabled  enabled
apt-daily.timer                enabled  enabled
backup.timer                   enabled  enabled
dpkg-db-backup.timer           enabled  enabled
e2scrub_all.timer              enabled  enabled
fstrim.timer                   enabled  enabled
motd-news.timer                enabled  enabled
systemd-sysupdate-reboot.timer disabled enabled

you should see backup.timer enabled alongside the standard ones.

What a defender takes away

  1. 1Timers live next to services in /etc/systemd/system.
  2. 2OnCalendar sets the schedule.
  3. 3Review timers with the same questions as cron: who, what, when.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    OnCalendar

  2. Show hint

    ExecStart in backup.service.