Scenario

A process is consuming excessive resources, but its origin is unclear.

Task

Create a utility script at /home/devops/trace_service.sh that accepts a PID argument and outputs its managing systemd service name, full status, and the last 20 log entries.

trace_service.sh Example:

#!/bin/bash

PID=$1
echo "PID: $PID"

# Extract service name managing this PID using systemd
# Hint: systemd can resolve a PID back to its unit
SERVICE=""

echo "SERVICE: $SERVICE"

echo "---- STATUS ----"
# Hint: show full systemd status for the identified service with --no-pager flag

echo "---- LOGS ----"
# Hint: show the last 20 log entries for the service from journald with --no-pager flag

Example

Running the script should produce a structured report similar to this:

root@server:~# ./trace_service.sh 4567

Service Identified: nginx.service

--- Status ---
● nginx.service - A high performance web server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
   Active: active (running) since Fri 2025-12-19 14:00:00 UTC; 1h ago
 Main PID: 4567 (nginx)

--- Last 20 Logs ---
Dec 19 14:00:01 server nginx[4567]: Starting web server...
Dec 19 14:00:02 server nginx[4567]: Configuration loaded successfully.
...

Solution

Step 1: Find high CPU process

ps aux --sort=-%cpu | head -n 10

Step 2: Note the PID (e.g., 4321)

Step 3: Identify systemd service from PID

systemctl status 4321

Example:

Loaded: loaded (/usr/lib/systemd/system/data-processor.service; enabled)` 

Extract the service name (e.g., data-processor.service).

Step 4: Get service name from output, then check full status (e.g., data-processor.service)

systemctl status data-processor.service

Step 5: View recent logs

sudo journalctl -u data-processor.service -n 20

Script

Create a file (nano or vim):

nano /home/devops/trace_service.sh

Put this in a script inside:

#!/bin/bash

PID=$1
echo "PID: $PID"

# Extract service name from systemctl status
SERVICE=$(systemctl status $PID --no-legend --no-pager | head -n 1 | awk '{print $2}')

echo "SERVICE: $SERVICE"

echo "---- STATUS ----"
systemctl status $SERVICE --no-pager

echo "---- LOGS ----"
sudo journalctl -u $SERVICE -n 20 --no-pager

Make executable:

chmod +x /home/devops/trace_service.sh

Run:

/home/devops/trace_service.sh

4321