Introducción

Some Linux services are designed to exit after initialization — and that trips up service monitors. If you're watching one of these with a Service monitor in Level, you'll get false alerts. The fix is a script monitor that reads SubState instead of ActivoState.

Why Monitor de servicioss Fire False Alertas

systemd tracks each unit across two status fields: ActivoState and SubState. Service monitors check ActivoState — values like active, inactive, or failed.

The problem: certain services exit after doing their job and never enter a persistent active state. WireGuard's wg-quick is the most common example. It configures the VPN interface, then exits. systemd records ActivoState as inactive (exited). A service monitor sees inactive and fires an alert — even though the VPN is running correctly, the interface is up, and traffic is routing.

SubState tells a more accurate story. For services like wg-quick, a healthy SubState is exited — expected and normal. A SubState of failed would mean something actually went wrong. Checking SubState directly is what lets you tell the difference.

Check SubState with a Script

Use systemctl show to read the SubState for any unit:

systemctl show -p SubState --value <unit_name>

This returns a single string — running, exited, dead, failed, etc. — that you can evaluate in a script monitor.

🖥️ PLATFORM NOTA:

Linux: Supported on any distribution using systemd.
Windows / macOS: Not applicable. systemctl is Linux-only.

Example: Monitoring a WireGuard Interface

The script below checks whether wg-quick@wg0 is in the expected exited SubState. Swap in your actual unit name if it's different.

#!/bin/bash

UNIT_NAME="wg-quick@wg0"
STATUS=$(systemctl show -p SubState --value $UNIT_NAME)

if [ "$STATUS" = "exited" ]; then
    echo "Service is running correctly."
    exit 0
else
    echo "ALERT: Service is not running. SubState: $STATUS"
    exit 1
fi

The script outputs a readable status string and exits with code 0 (healthy) or 1 (unexpected state). Configurar the script monitor to trigger when output Contains the failure string of "ALERT".

Monitor configuration:

Field	Value
Escriba	Run script
OS	Linux
Script	Linux - WireGuard SubState Check
Script output	Contains
Value	`ALERT`
Run frequency	5 minutes
Trigger count	2

💡 CONSEJO: Set Trigger count to 2 or higher to avoid alerts from transient states during service restarts or reboots.

Other Unit Escribas That Exit by Design

wg-quick is the most common case, but any of these can trigger the same false-alert pattern:

Oneshot services — run a task and exit; SubState will be exited when healthy
Horar units — run on a schedule; check ActivoState for the timer unit itself, not the service it launches
Escriba=forking services — parent process exits after spawning a child; SubState may be exited while the child runs

For all of these, a script monitor checking SubState against your known-good value is the right approach.

Preguntas frecuentes

My WireGuard service shows as Down in Level but traffic is routing fine. What's happening? wg-quick exits after setting up the VPN interface — that's normal. The network interface stays active even though the service process exited. A service monitor sees inactive and fires an alert. Use a script monitor that checks SubState (which returns exited, the healthy value) instead.
How do I know what SubState value to expect when a service is healthy? Run systemctl show -p SubState --value <unit_name> on a device where the service is working correctly. Whatever it returns is your healthy baseline. Script against that value.
Can I check both ActivoState and SubState in the same monitor? Sí. Write the script to read both and fail if either is unexpected. This gives you broader coverage — you can catch services that exited unexpectedly (SubState: failed) separately from services that are simply stopped (ActivoState: inactive).
Does this work on Linux distributions that don't use systemd? No. systemctl requires systemd. On distributions using SysVinit or Upstart, you'd need different tooling (e.g., service <name> status). Most actively-maintained Linux distributions ship with systemd.

Monitoring systemd Unit Files on Linux