5

I have a specific systemd service that I don't want its log to be logged to journald/journalctl. For now the reason is that it already logs to syslog (already rotated) and the journald/journalctl log is flooded by that service's log (disk space issue).

For now I have changed journald/journalctl's config to Storage=volatile so it's not writing to disk too much. I know that I can change SystemMaxUse and SystemKeepFree in /etc/systemd/journald.conf, but it's not ideal since logs from other services will be overwritten by that one specific service. I want to keep using journald/journalctl, but just not for that one specific service.

Is there any configuration that I can change in /etc/systemd/system/myservice.service service unit file so that it's not logged to journald/journalctl?

1

3 Answers 3

3

Create a separate logging namespace for your unit and customize its logging config as you wish:

in /etc/.../myapp.service:

[Service]
...
LogNamespace=noisy

Create a new config for that namespace:

cd /etc/systemd
cp journald.conf [email protected]
nano [email protected]

And edit the config however you wish. E.g. I just set it to Storage=volatile and RuntimeMaxUse=10M because I don't give a hoot about my app's syslog logs (I already have sufficient app logs). N.B.: When storage is volatile, it uses Runtime* vars, not System* vars.

Reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart myapp # maybe this is not necessary? Lmk if you find out

Source: https://wiki.archlinux.org/title/Systemd/Journal#Per_unit_size_limit_by_a_journal_namespace

1
  • 1
    I used this approach to change ForwardToSyslog for a unit and had to restart it before it would stop forwarding, so it seems like restarting is necessary
    – raylu
    Jan 24 at 23:14
0

There is no systemd configuration that will allow you to disable journald for a service, but still forward to other syslog daemons like rsyslog. What I have seen done in custom c++ programs is bypassing journald logging, and instead opening direct connections to the socket monitored by rsyslog, /run/systemd/journal/syslog.

1
  • 2
    as I said in my question, the service already writes log to syslog by itself (not forwarded by systemd, but the service itself is writing to syslog). So what I want to accomplish is to just turn off logging to journald only for that service.
    – Kristian
    Jun 8, 2022 at 2:06
-1

Per Arch Linux Wiki: Systemd/Journal:

In Arch Linux, the directory /var/log/journal/ is a part of the systemd package, and the journal (when Storage= is set to auto in /etc/systemd/journald.conf) will write to /var/log/journal/. If that directory is deleted, systemd will not recreate it automatically and instead will write its logs to /run/systemd/journal in a nonpersistent way. However, the directory will be recreated if Storage=persistent is added to journald.conf and systemd-journald.service is restarted (or the system is rebooted).

so all you have to do is rename /var/log/journal (or wherever your journald stores its logs) and journald won't be writing anything to disk, a behavior that often drives me to the wall 'cuz I just wanna get to desktop in a jiffy but have to wait for journald to write logs to disk :)

1
  • 2
    this is not what I'm asking. What I want is to disable logging to journald only for one specific service, other service should still log to journald
    – Kristian
    Sep 1, 2022 at 1:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .