The Redundant Logger
In a standard Ubuntu Server installation, rsyslog is the default system logging daemon. It actively collects log messages from the kernel and various background services, writing them to files located in the /var/log directory (such as syslog, auth.log, and kern.log).
However, modern Linux environments have heavily shifted toward using systemd-journald (which captures and indexes all the same logs in a binary format accessible via the journalctl command). Furthermore, if you are running Ubuntu inside a Docker container or a highly ephemeral cloud instance where logs are instantly forwarded to a centralized aggregator (like Datadog, ELK, or CloudWatch), having rsyslog continuously duplicating logs to local disk files is a waste of CPU cycles, disk I/O, and storage space. You can safely disable it.
How to Disable the Rsyslog Service
You can turn off the legacy logging daemon using systemctl.
- Open your Ubuntu Terminal (or connect via SSH).
- Stop the running service to prevent any further disk writes immediately:
sudo systemctl stop rsyslog.service- Disable the service so it does not start automatically on the next boot:
sudo systemctl disable rsyslog.service- To ensure no other application attempts to wake the service up to write a legacy log file, mask it:
sudo systemctl mask rsyslog.serviceYour system will stop writing redundant flat-file logs to /var/log. You can still read all essential system logs using journalctl, and your disk I/O will be notably reduced, optimizing your container or cloud environment.