Prevent syslogs from being logged under journalctl

Question

I have a simple Python snippet managed by a systemd service which logs to the rsysogd daemon where I've defined a configuration file to put it to a syslog server with a format I've defined. This is working fine so far.

In the code below, I'm passing the argument as the string I want to log on the server. I'm using this code below as a module and using it for logging alone, the actual script uses this for logging purposes.

#!/usr/bin/env python

import syslog
import sys

syslog.openlog(facility=syslog.LOG_LOCAL0)
syslog.syslog(syslog.LOG_INFO, sys.argv[1])

Since the application is managed by systemd it is making a copy of the syslog available when seen from the journalctl -xe and the journalctl -u <my-service> which I do not wish to happen because I've other critical information I'm logging in journal logs.

The service definition is

[Unit]
Description=Computes device foobar availability status

[Service]
Type=simple

EnvironmentFile=/etc/sysconfig/db_EndPoint
ExecStart=/usr/bin/python /opt/foobar/foobar.py
WatchdogSec=60
RestartSec=10
Restart=always
LimitNOFILE=4096

[Install]
WantedBy=default.target

and in the /etc/systemd/journald.conf file, I've not enabled any of the options to be available. I looked up this journald.conf documentation to use ForwardToSyslog=no and did a restart of journald service as

systemctl restart systemd-journald

and also restarted my service unit, but I see the logs out to the syslog server and also to the journal logs. What option I'm missing here?

score 4 · Accepted Answer · answered Jan 08 '18 at 16:00

I have a simple Python snippet managed by a systemd service which logs to the rsys[l]ogd daemon […]

No you haven't.

What you have is a service that logs to the systemd journal. The server listening on the well-known /dev/log socket that your Python program is talking to is not rsyslogd. It is systemd-journald. rsyslogd is attached to the other side of systemd-journald, and your Python program is not talking to it.

From this, it should be apparent that the only way to not send stuff via systemd-journald is to use some other route to rsyslogd, not the well known socket that your Python library uses by default. That all depends from how you have configured rsyslogd.

It is possible that you have turned on a UDP server with the imudp module, in which case you could tell your Python program to use that by using a different Python library that speaks to such a UDP server. (The Python syslog library is hardwired to use the well-known local socket.)
Or (and better, given that you have to be careful about not opening a UDP service to the world outwith your machine) you could have given rsyslogd a second, not well known, AF_LOCAL socket to listen to by configuring this in the imuxsock module's configuration. Again, you'll have to tell your Python program to use that and use a different Python library.

What exactly you do in your Python program is beyond the scope of this answer.

Prevent syslogs from being logged under journalctl

1 Answers1

Further reading