David - Musings of an SRE

Disabling Systemd Service from Logging to Syslog

The following might be useful for those who want to disable their systemd services from logging into /var/log/syslog but still maintain the ability to view the logs via journalctl -u <service>

Caveat: Unfortunately journal and syslog are quite coupled together, you can’t configure your specific systemd service to disable syslog logging without disabling it from journald via a configuration toggle.

But! It is not impossible, you just have to deal with an extra step.

These are some of the possible implementations that might be useful:

Method Showing on Syslog Showing on Journal
Option 1: Global disable syslog forward ❌ (all services will not be displayed)
Option 2: Log to File
Option 3: RSyslog Ignore
Option 4: Send Service Logs to Null

Option 1: Globally disable syslog forwarding

In /etc/systemd/journald.conf:

[Journal]
ForwardToSyslog=no

This would globally prevent journald from sending ALL the journal logs to syslog and not just a specific service that you want disabled. You will still retain your logs in journald but no longer see it in /var/log/syslog.

Option 2: Log to File

In your systemd/<servicename>.service:

[Service]
...
StandardOutput=append:/path/to/log/stdout.log
StandardError=append:/path/to/log/stderr.log

This sends the logs directly to files but prevents it from appearing on both your syslog and journald

Option 3: Have rsyslog ignore logging

In /etc/rsyslog.d/ignore-service.conf (can be any filename you prefer)

if $programname == "<service_name>" then stop

This hooks into the rsyslog process and filters the logs out from your service before it reaches /var/log/syslog

⚠️ Important: If your service is executing a separate script, $programname might not be your <service_name>. Take a look at your /var/log/syslog and see how it is being taggedd and replace <service_name> above with the tagged name.

Option 4: Send Service Logs to Null

In your systemd/<servicename>.service:

[Service]
StandardOutput=null
Standarderror=null

Summary

Disabling rsyslog by adding an ignore filter (Option #3) would be my recommended option as it maintains the default and status quo for all the other services while only affecting the specific service that you might want to have an exception to logging.