20

My computer runs serveral java processes as systemd services.The systemd logs get accumulated in the syslog eventually leading to low disk space . How to re-direct the logs started by systemd services towards /dev/null so that it does not accumulate in syslog.The machine is constantly running out of disk space due to this issue.However , I need to be able to use journalctl to view the systemd service logs. The possible solutions I found were :

1.To modify configurations in /etc/systemd/journald.conf by setting 'ForwardToSyslog=no'

2.Adding StandardOutput=null within the systemd service file itself

However the first solution completely stopped all the logs sent to syslog and solution 2 did not work.I wish to stop forwarding only the log messages from systemd services.

achilles
  • 536
  • 5
  • 16

6 Answers6

4

The second option with StandardOutput=null should work. I think what you need is to redirect also STDERR to /dev/null, by adding StandardError=null. Summarize - in your *.service file should be two lines:

[Service]
StandardOutput=null
StandardError=null

Refer SYSTEMD.EXEC(5) man page for more details.

BarbosSergos
  • 314
  • 1
  • 8
  • 9
    But this solution disables the logs completely, so you can't watch them via `journalctl -u -f` anymore :/ Is there a way to keep journald but not forward to syslog? – Konstantine Rybnikov Dec 02 '21 at 13:29
  • we configured rsyslog to write logs for given service also for our specific location, after disabling this logging, `journalctl` stopped working, but we have logs available in our desired location at least – 32cupo Jan 12 '23 at 12:56
3

Similarly on a Redhat 7.4 box, running systemd-219-42.el7_4.1.x86_64, I was unable to turn off log redirection with the ForwardToSyslog=no setting in /etc/systemd/journald.conf.

I instead had success with setting MaxLevelSyslog=warning which removed all the INFO and DEBUG level messages that were being forwarded to rsyslog.

JamesThomasMoon
  • 6,169
  • 7
  • 37
  • 63
Shaun Dewberry
  • 236
  • 1
  • 5
3

If your service is logging to a file, the messages will not be appended to systemd syslog.

For example:

[Service]
StandardOutput=append:/var/log/python-script-stdout.log
StandardError=append:/var/log/python-script-stderr.log

will forward all messages (stdout and stderr) only to their respective filepath.

If you want to truncate the logs on every service startup, replace append: with file:.

Binar Web
  • 867
  • 1
  • 11
  • 26
2

You can configure rsyslog to ignore logs from specific application:

# cat /etc/rsyslog.d/mydaemon.conf 
if $programname == 'mydaemon' then {
    stop
}

This will result in:

  1. You will see systemd-generated messages about daemon being started/stopped/reloaded/etc within journal AND syslog.
  2. You will see daemon's-generated messages ONLY in journal (and custom log file written directly by application, if any).
Vincas Dargis
  • 535
  • 5
  • 14
1

You can still use "syslog" to redirect logs from the service to /dev/null. In your system file try:

[service]
SyslogIdentifier=<service-name>
StandardOutput=null
SyslogFacility=local7

Meanwhile, check that the syslog deamon is configured to receive logs with local7 facility. In rsyslog configuration file make sure that:

local7.*    /dev/null

journalctl should still be working.

check out the systemd manual for more information

Lemonina
  • 712
  • 2
  • 14
  • this worked for me, although adding more details regarding how to check the local7 facility would have been even nicer. – xCovelus Apr 28 '23 at 14:40
  • 1
    check if syslog daemon is configured to receive logs with the local7 facility by looking for `local7.*` in `rsyslog` configfile -- this tells syslog daemon to process all log messages with local7 facility -- `local7.* /var/log/local7.log` means that syslog daemon is configured to process logs with the local7 facility and save them to the /var/log/local7.log file -- update the configuration file to redirect logs with the local7 facility to /dev/null `local7.* /dev/null` -- syslog daemon discards all logs with the local7 facility including logs from systemd services -- I hope this is helpful – Lemonina May 01 '23 at 06:05
0

Alternatively, you can use the journalctl command to limit the size of the journal. You can limit the size of the journal to a certain size, by adding the following line to /etc/systemd/journald.conf:

SystemMaxUse=10M

This will limit your journal to 10 MB.

The 5th column mouse
  • 710
  • 1
  • 4
  • 11