Disabling Systemd Service from Logging to Syslog
The following might be useful for those who want to disable their systemd services from logging into /var/log/syslog
but still maintain the ability to view the logs via journalctl -u <service>
Caveat: Unfortunately journal and syslog are quite coupled together, you can’t configure your specific systemd service to disable syslog logging without disabling it from journald via a configuration toggle.
But! It is not impossible, you just have to deal with an extra step.
These are some of the possible implementations that might be useful:
Method | Showing on Syslog | Showing on Journal |
---|---|---|
Option 1: Global disable syslog forward | ❌ (all services will not be displayed) | ✅ |
Option 2: Log to File | ❌ | ❌ |
Option 3: RSyslog Ignore | ❌ | ✅ |
Option 4: Send Service Logs to Null | ❌ | ❌ |
Option 1: Globally disable syslog forwarding
In /etc/systemd/journald.conf
:
[Journal]
ForwardToSyslog=no
This would globally prevent journald from sending ALL the journal logs to syslog and not just a specific service that you want disabled. You will still retain your logs in journald but no longer see it in /var/log/syslog
.
Option 2: Log to File
In your systemd/<servicename>.service
:
[Service]
...
StandardOutput=append:/path/to/log/stdout.log
StandardError=append:/path/to/log/stderr.log
This sends the logs directly to files but prevents it from appearing on both your syslog
and journald
Option 3: Have rsyslog ignore logging
In /etc/rsyslog.d/ignore-service.conf
(can be any filename you prefer)
if $programname == "<service_name>" then stop
This hooks into the rsyslog process and filters the logs out from your service before it reaches /var/log/syslog
⚠️ Important: If your service is executing a separate script, $programname might not be your
<service_name>
. Take a look at your/var/log/syslog
and see how it is being taggedd and replace<service_name>
above with the tagged name.
Option 4: Send Service Logs to Null
In your systemd/<servicename>.service
:
[Service]
StandardOutput=null
Standarderror=null
Summary
Disabling rsyslog by adding an ignore filter (Option #3) would be my recommended option as it maintains the default and status quo for all the other services while only affecting the specific service that you might want to have an exception to logging.