Operate running systems
Boot and targets
systemctl get-default and systemctl set-default multi-user.target (or graphical.target) control the default target; systemctl isolate rescue.target switches immediately without changing the default. systemctl --failed lists broken units. Unit files shipped by packages live in /usr/lib/systemd/system; your changes belong in /etc/systemd/system via systemctl edit or a drop-in. After editing any unit, systemctl daemon-reload is mandatory, then systemctl enable --now name.
Processes and logs
Know ps aux, ps -ef, top, pgrep -u, nice, renice, and kill -SIGNAL pid (TERM is 15 and the default, KILL is 9, HUP is 1). Journald: journalctl -u sshd -f, -b, --since "1 hour ago", -p err. Persistent journals need Storage=persistent in /etc/systemd/journald.conf plus a /var/log/journal directory. Scheduled work uses crontab -e/-l/-u user, at now +5 min, and systemctl enable --now crond.
Recovery
To reset a forgotten root password: edit the kernel line in GRUB, append rd.break, boot, then mount -o remount,rw /sysroot, chroot /sysroot, passwd root, touch /.autorelabel, exit, exit.
Traps: editing the unit file under /usr/lib - a package update overwrites it. Skipping daemon-reload makes edits appear to do nothing. systemctl start alone does not survive a reboot.
Rule of thumb: enable is boot-time, start is now; enable --now does both.
Worked example: systemctl edit --full httpd then systemctl daemon-reload && systemctl restart httpd