Ask Your Question

How to correctly disable journald

asked 2015-02-18 10:03:21 -0500

covex gravatar image

I'd like to disable logging to journal and stick with rsyslog. I looked for correct solution and so far found it is not possible to disable journal at all. There is just an option to set


in journald.conf. From that time on, journaclt displays old log entries from journal on disk - well ok, never mind.. Man says journald should forward to syslog (ForwardToSyslog=yes by default).

However the text log files are not anymore the same as they were and are missing some sections. E.g. with F21 I am completely without a log from Xorg that is now redirected to journal. I also found it may be needed to use

$AddUnixListenSocket /run/systemd/journal/syslog

in rsyslogd, but it did not changed anything. How do I properly set journald to log everything to rsyslog?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2015-02-18 11:18:58 -0500

poettering gravatar image

This is simply not supported. All services systems starts have their stdout/stderr connected to journald, thus journald really needs to run.

Modern versions of rsyslog actually get their data from the journal, and do not rely on journald forwarding the logs via ForwardToSyslog=yes. To be able to get the data from the journal you need to turn on storage howver, either persistently or volatile. Turning it off entirely with Storange=none means you completely lose all data unless you then teach rsyslog to get the data via the forwarding again, and not from the journal.

Anyway, if you don't want to use journalctl and only want to use rsyslog, then set Storage=volatile.

edit flag offensive delete link more

answered 2016-04-21 12:42:35 -0500

Hi. I have been searching how to implement disabling journald.

I was thinking the first solution issue author suggested, via journald.conf but I think that stopping or masking service could be enough to implement that:

You also can list that service with yum: yum info systemd so you also could use systemctl to stop journald.There are 2 units, service and socket (first one I think to logging your server info and socket to act as a client and receiving information from other sources):

systemd-journald.service systemd-journald.socket

You should be able to perform systemctl stop systemd-journald.service and systemctl stop systemd-journald.socket

Also I was wondering how could I do to upload journal logs to other servers and in newest versions of journald it seems it's implemented through systemd-journal-upload starting in journald version 2.16.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2015-02-18 10:03:21 -0500

Seen: 10,577 times

Last updated: Apr 21 '16