My last question What are the options to manage the size of /var/log/syslog of an embedded system was not answered so I am asking this question to see if it is possible to stop using /var/log/syslog and just use the systemd logs.

I don't want this file to grow in the future (embedded system) and I don't want to use logrotate to manage it since I can use the systemd logs which are governed by the rules I can set in /etc/systemd/journald.conf.

In other words, I don't want to have two systems for logs. Personally, I prefer /etc/log/syslog because it's a text file while systemd's logs are binary, but since systemd manages its own log and is a component of the operating system that cannot be removed, I figure it's better to let it manage the system logs.

Is it enough to disable the transfer of log messages to syslog by setting the "ForwardToSyslog" key to "no" in "/etc/systemd/journald.conf" and stopping and disabling the rsyslog service ?

1 Answer 1


I believe the easiest way would be to stop and disable the rsyslog.service and its corresponding syslog.socket:

$ sudo systemctl disable --now syslog.socket rsyslog.service

This should effectively disable rsyslogd from running.

On the same note, it should also be possible to disable the systemd-journald.service in the exact same way:

$ sudo systemctl disable --now systemd-journald.service
  • if I disable the redirection of log messages to syslog in the systemd configuration and disable Rsyslog, the /var/log/syslog file will no longer be used and I can delete it ?
    – Aminos
    Apr 19 at 13:31
  • 1
    Correct. Should you ever need rsyslog again, enabling and starting it should recreate the correct logfiles. Apr 19 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.