How to disable log duplication with systemd-journald

Question

I just installed a raspberry pi with debian bullseye and I noticed that /var/log has both the traditional log files in text format, such as kern.log, daemon.log, and syslog, as well as the new directory journal used by journalctl. These appear to be duplicate, I only use journalctl and don't want the text files.

How can I disable the traditional way and ensure that no log entries are omitted, ie journalctl has everything ?

Here is the listing of /var/log, note the presence of both text files and the journal directory.

total 960
-rw-r--r--  1 root root              3137 Jul  6 17:51 alternatives.log
drwxr-xr-x  2 root root              4096 Jul  6 18:02 apt
-rw-r-----  1 root adm              12453 Jul  6 18:02 auth.log
-rw-r--r--  1 root root                 0 Apr  4 16:41 bootstrap.log
-rw-rw----  1 root utmp              1600 Jul  6 17:27 btmp
-rw-r-----  1 root adm             131074 Jul  6 18:03 daemon.log
-rw-r-----  1 root adm               4356 Jul  6 17:42 debug
-rw-r--r--  1 root root            109320 Jul  6 18:02 dpkg.log
-rw-r--r--  1 root root                 0 Apr  4 16:41 faillog
-rw-r--r--  1 root root               484 Jul  6 17:51 fontconfig.log
drwxr-sr-x+ 3 root systemd-journal   4096 Apr  4 16:41 journal
-rw-r-----  1 root adm             169704 Jul  6 18:03 kern.log
-rw-rw-r--  1 root utmp            296296 Jul  6 17:54 lastlog
-rw-r-----  1 root adm             168196 Jul  6 18:03 messages
drwx------  2 root root              4096 Apr  4 16:41 private
drwxr-xr-x  3 root root              4096 Apr  4 16:28 runit
-rw-r-----  1 root adm             305804 Jul  6 18:03 syslog
-rw-r-----  1 root adm               1413 Jul  6 17:42 user.log
-rw-rw-r--  1 root utmp             12000 Jul  6 17:54 wtmp

Answer 1

Artem's comment is the good, many thanks. The link to a previous post on the same topic is also a very good explanation. I subsequently purged rsyslog and everything still works fine and without any log duplicates.

As stated above my motivation was that I use log2ram on the raspberry pi to reduce wear of the sdcard caused by writing logs. However, the in-memory filesystem kept filling up.

Removing rsyslog significantly simplifies working with log2ram because the maximum logsize is predicable. It can be set to a maximum size, here 20MB, as follows: sudo perl -pe 's/^#?SystemMaxUse=.*$/SystemMaxUse=20M/g' -i /etc/systemd/journald.conf

Because there are no other log files written anymore and journald ensures a maximum size, configuring logrotate is no longer required. And zram compression is also obsolete because the journald format is binary. Nice and simple.

Hope this helps someone.

Answer 2

Completely removing the rsyslog is not necessary. For example, one might want to avoid duplication of log messages but still use logger in scripts to write custom log entries.

To switch off the log forwarding from systemd-journald to rsyslog, it is sufficient to change the line ForwardToSyslog=yes in the journald configuration. On my system running openSUSE Leap 15.4, this is not in /etc/systemd/journald.conf, but in /usr/lib/systemd/journald.conf.d/30-rsyslog.conf. It may be different on your system.

After changing this value to no and restarting the systemd-journald service, the log forwarding should be off. Which can be easily checked by observing /var/log/messages.