My last question What are the options to manage the size of /var/log/syslog of an embedded system was not answered so I am asking this question to see if it is possible to stop using /var/log/syslog and just use the systemd logs.
I don't want this file to grow in the future (embedded system) and I don't want to use logrotate to manage it since I can use the systemd logs which are governed by the rules I can set in /etc/systemd/journald.conf.
In other words, I don't want to have two systems for logs. Personally, I prefer /etc/log/syslog because it's a text file while systemd's logs are binary, but since systemd manages its own log and is a component of the operating system that cannot be removed, I figure it's better to let it manage the system logs.
Is it enough to disable the transfer of log messages to syslog by setting the "ForwardToSyslog" key to "no" in "/etc/systemd/journald.conf" and stopping and disabling the rsyslog service ?
1 Answer
I believe the easiest way would be to stop and disable the rsyslog.service and its corresponding syslog.socket:
$ sudo systemctl stop syslog.socket
$ sudo systemctl stop rsyslog.service
$ sudo systemctl disable syslog.socket
$ sudo systemctl disable rsyslog.serviceThis should effectively disable rsyslogd from running.
On the same note, it should also be possible to disable the systemd-journald.service in the exact same way:
$ sudo systemctl stop systemd-journald.service
$ sudo systemctl disable systemd-journald.service
