The Redundant Logging Daemon
Historically, Linux systems relied on the syslog daemon (and later rsyslog) to collect, process, and write system logs to plain-text files located in the /var/log/ directory. Ubuntu, like most modern Linux distributions, has transitioned to using systemd as its init system. Systemd includes its own highly efficient, binary logging daemon called systemd-journald.
By default, Ubuntu runs both logging systems simultaneously. journald captures all the logs, and then it forwards a copy of those logs to rsyslog, which writes them out as plain text to /var/log/syslog. This dual-logging setup is redundant. It means your server is spending CPU cycles processing every log entry twice and consuming double the disk space to store identical data. If you are comfortable using the journalctl command to read the binary journal, you can safely disable the legacy rsyslog daemon.
How to Disable the Rsyslog Service
You can stop the legacy text-logging daemon using systemctl.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the currently running service:
sudo systemctl stop rsyslog.service- Disable the service to prevent it from starting on the next boot:
sudo systemctl disable rsyslog.service- (Optional) You can now delete the massive plain-text log files to free up disk space, as they will no longer be updated:
sudo rm /var/log/syslog* /var/log/auth.log* /var/log/kern.log*Your Ubuntu system will now rely exclusively on systemd-journald. To view your logs going forward, you must use the terminal command journalctl (e.g., journalctl -u nginx.service or journalctl -xe).