3

I use centralized logging with rsyslog, which means that there are dedicated logging servers which collect syslog messages from all servers.

All inspections of logs are done from those logging servers, which means that system administrators never SSH the machines themselves to view the local /var/log/* files.

In order to (slightly) reduce disk usage, I think that it could be a good idea to disable local syslog.

  • How do I do that? Is it enough to just remove the $IncludeConfig /etc/rsyslog.d/*.conf line from /etc/rsyslog.conf?

  • And more importantly, are there any drawbacks or risks of doing it? I recall reading that when centralized logging is used, some log messages can be lost (I'll check if messages were lost for a few weeks by comparing local and centralized logs to check if this is the case here.) Are there other risks?

Note: if it matters, the distribution is Ubuntu 14.04, but I'm interested in answers for other distributions as well.

  • It may seem trivial, but if you direct your logs by a file inside /etc/rsyslog.d/ it also would prevent the logs being sent to the logserver. I removed all other files except the file which sends the logs. For people being curios, its content is . @logs.domain.tld – DBX12 Dec 14 '16 at 14:38
1

If you disable it, you should set your transport method to TCP. UDP is the default, which has no error control. You're correct about removing the line for local logging. That conf file tells rsyslog what the source and destination is for logging, so if you remove a destination, it just won't go there anymore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.