1

My last question What are the options to manage the size of /var/log/syslog of an embedded system was not answered so I am asking this question to see if it is possible to stop using /var/log/syslog and just use the systemd logs.

I don't want this file to grow in the future (embedded system) and I don't want to use logrotate to manage it since I can use the systemd logs which are governed by the rules I can set in /etc/systemd/journald.conf.

In other words, I don't want to have two systems for logs. Personally, I prefer /etc/log/syslog because it's a text file while systemd's logs are binary, but since systemd manages its own log and is a component of the operating system that cannot be removed, I figure it's better to let it manage the system logs.

Is it enough to disable the transfer of log messages to syslog by setting the "ForwardToSyslog" key to "no" in "/etc/systemd/journald.conf" and stopping and disabling the rsyslog service ?

Improve this question

1 Answer 1

Reset to default
1

I believe the easiest way would be to stop and disable the rsyslog.service and its corresponding syslog.socket:

$ sudo systemctl disable --now syslog.socket rsyslog.service

This should effectively disable rsyslogd from running.

On the same note, it should also be possible to disable the systemd-journald.service in the exact same way:

$ sudo systemctl disable --now systemd-journald.service
Improve this answer
2
  • if I disable the redirection of log messages to syslog in the systemd configuration and disable Rsyslog, the /var/log/syslog file will no longer be used and I can delete it ?
    – Aminos
    Apr 19, 2022 at 13:31
  • 1
    Correct. Should you ever need rsyslog again, enabling and starting it should recreate the correct logfiles.
    – Artur Meinild
    Apr 19, 2022 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .