How to Disable Journal Logging for Specific systemd Service Unit to Reduce Disk Usage


15 views

When running services under systemd, some applications (particularly chatty ones or those with verbose debug logging) can generate massive journal logs. I recently encountered a custom service writing 1GB/day of non-critical debug information to journald. Here's how to surgically disable logging for just that unit.

The cleanest method uses StandardOutput and StandardError directives in the unit file:

[Service]
# Existing configuration...
StandardOutput=null
StandardError=null

After modifying, reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart yourservice.service

If you want to keep some logs but reduce volume:

[Service]
# Limit to 100 messages per 30 seconds
RateLimitIntervalSec=30s
RateLimitBurst=100

For system-wide control, edit /etc/systemd/journald.conf:

[Journal]
# Discard all logs from this unit
Storage=volatile
SystemMaxUse=1G
# Unit-specific override (add to bottom):
[JournalFilters]
Match_UID=systemd
Match_SYSTEMD_UNIT=yourservice.service
Action=discard

Check log reduction with:

journalctl --unit=yourservice.service --since=-1h

For persistent units, create a drop-in file at /etc/systemd/system/yourservice.service.d/nolog.conf instead of modifying the main unit file.

  • This doesn't affect application-level logging to files
  • Consider adding SyslogIdentifier= if using external logging
  • For Docker containers, set --log-driver=none instead

When dealing with verbose systemd units that generate excessive logs (like those producing 1GB/day mentioned), it's crucial to understand the logging architecture. Systemd's journald service collects logs from all units by default, which can lead to:

  • Disk space exhaustion
  • Reduced system performance
  • Difficulty finding relevant logs

The most surgical method is to configure journald to ignore specific units:

# /etc/systemd/journald.conf.d/override.conf
[Journal]
MaxLevelStore=warning
SystemMaxUse=1G
# Add unit-specific filters
LogFilterPatterns=_SYSTEMD_UNIT=spammy.service

Note: This requires systemd v246+ and may not work on older distributions.

For more precise control, modify the unit file itself:

# Example unit override
# systemctl edit spammy.service
[Service]
StandardOutput=null
StandardError=null
LogLevelMax=warning

For services that must keep stdout/stderr:

# Create a filter unit
# /etc/systemd/system/spammy-filter.service
[Unit]
Description=Log filter for spammy service

[Service]
ExecStart=/bin/sh -c "journalctl -u spammy.service -f | grep -v 'DEBUG:'"
StandardOutput=journal

After changes, always verify and maintain:

# Reload configuration
sudo systemctl daemon-reload
sudo systemctl restart spammy.service

# Verify logging is reduced
journalctl -u spammy.service --since "1 hour ago" -n 20

For critical production systems:

# Create private journal namespace
sudo mkdir -p /var/log/journal/spammy
sudo systemd-tmpfiles --create --prefix /var/log/journal/spammy

# Configure namespace
# /etc/systemd/journald@spammy.conf
[Journal]
Storage=volatile
MaxLevelStore=warning