How do I permanently disable all logs that appear in
/var/log/? I tried "service rsyslog stop", "systemctl disable rsyslog" but it still logs stuff because I type "sudo journalctl --vacuum-time=1s" and it deletes 5.7M of logs each time I reboot.
Journald does potentially consume a lot of disk space compared to the traditional text based logging done by
rsyslog. In addition, since both are enabled by default in Raspbian, there is the implication that you will end up with redundant waste.
Fortunately, that's not quite how it is configured; from
To enable persistent logging, create /var/log/journal:
mkdir -p /var/log/journal systemd-tmpfiles --create --prefix /var/log/journal
systemd will make the journal files owned by the "systemd-journal" group and add an ACL for read permissions for users in the "adm" group.
This works because journald's default
Storage mode is
auto, meaning the logs will be kept in memory unless
/run/log/journal exists1 -- and they do not in the base image. You will find these settings (
Storage, etc.) in
/etc/systemd/journald.conf, and an explanation of them in
man journald.conf; note that all of them are commented out, so journald policy defaults, explained in the man page, are used.
This means the
rsyslog text records are unique. That README (which is worth a browse) also notes that "If you enable persistent logging, consider uninstalling rsyslog or any other system-log-daemon, to avoid logging everything twice."
Limiting text files
Storage of the text logs, created by rsyslog, can be controlled with
man logrotate and
man logrotate.conf (there's also no shortage of material online about it). This rolls the files over, potentially compresses them, and discards based on volume and/or age. Traditionally logrotate is executed by cron, but current Raspbian does it via a systemd timer (see
/etc/systemd/system/timers.target.wants/logrotate.timer; check that it really is enabled with
systemctl status logrotate.timer).
Journald has a conf file,
/etc/systemd/journald.conf. All the settings there are (as mentioned above) commented out, but it can be configured to guarantee that no disk space at all is used regardless of whether
/var/log/journal exists.2 This is probably not desirable unless rsyslog, which writes the text files, is also running, so that there will at least potentially be some record left if the system crashes, if you want to compare current state to a previous point in time, etc.
To restrain journald, add this under
[Journal] in the conf file:
This means the logs will be kept in memory with a 64 MB limit; entries are then discarded based on age (it may be more complicated than that, but it is mostly age). You can play around to see how far back 64 MB will get you, but it is probably at least a couple of days.
RuntimeMaxUse applies only to logs in memory, but there is a parallel parameter for the "on disk" persistent storage,
Putting it together
So, that outlines too basic methodologies for logging with a size/time constrained permanent record:
- Disable rsyslog, create
jounrnald.conf, leave rsyslog alone, and tailor
/etc/logrotate.d/*, from which it sources) to your liking.
The latter is the default scenario on Raspbian, but the logrotate configuration does not set any size constraints, only time based ones (to do that, see the doc references for logrotate above).
/run/log/journalwould actually just be in memory too, as
/runis a tmpfs filesystem. But it would give you additional access.
Call me paranoid but I suspect there may be some applications or services that decide to create these when installed. Either way, using
volatileis harmless if in-memory only is what you want.
If your intent is to reduce the potential for SD card corruption, then you should look at Adafruits tutorial for a "Read Only Raspberry Pi" -
https://www.raspberrypi.org/blog/adafruits-read-only/ It is not perfect, but it will stop all logging and seems to survive most inadvertent power failures.