In Ubuntu Server, system logging is traditionally handled by the rsyslog daemon. This background service constantly monitors the kernel and various background applications, writing every single event, error, and notice to text files located in the /var/log/ directory (such as syslog, auth.log, and kern.log).
While this is standard practice for enterprise logging, it is entirely redundant on modern systemd-based Linux distributions. Systemd already runs its own extremely robust logging daemon called systemd-journald, which captures all the exact same information and stores it in a highly efficient, queryable binary format accessible via the journalctl command. Running both journald and rsyslog simultaneously means your server is wasting CPU cycles and disk I/O writing every log entry twice. If you are comfortable using journalctl and want to optimize your server’s disk usage (especially on SD-card based systems like Raspberry Pis or embedded IoT devices), you must completely disable the legacy rsyslog daemon.
Stopping and Disabling Rsyslog via Systemctl
You can gracefully terminate the legacy logging daemon and prevent it from starting upon the next reboot.
- Open a Terminal session (or connect to your server via SSH).
- First, stop the daemon if it is currently running in the background:
sudo systemctl stop rsyslog.service - Next, permanently disable the service so that it does not automatically launch the next time you reboot the server:
sudo systemctl disable rsyslog.service
Uninstalling Rsyslog Entirely (Recommended)
To guarantee that no cron jobs or legacy dependencies attempt to resurrect the text-based logger, you should purge the software from your hard drive.
- In the terminal, run the following command to completely uninstall the package and delete its configuration files:
sudo apt-get purge rsyslog - Press Y when prompted to confirm the removal.
- Clean up any orphaned dependencies left behind:
sudo apt-get autoremove - Finally, you can safely delete the massive legacy text files that are no longer being updated, instantly freeing up disk space:
sudo rm -rf /var/log/syslog*sudo rm -rf /var/log/auth.log*sudo rm -rf /var/log/kern.log*
Your Ubuntu server is now optimized. It will continue to log every critical system event flawlessly using systemd-journald, but it will no longer waste precious disk writes endlessly updating redundant flat text files.