Disabling syslogd in FreeBSD

Question

I'm running FreeBSD in a very small VM with about 1.5G of space. I'd like to disable syslogd to save disk space, but there is no entry for it in /etc/rc.conf. service -e shows that syslogd is indeed running. How do I disable/uninstall it?

score 3 · Answer 1 · answered Dec 30 '15 at 06:28

Igor's answer is good but I'd like to expand on it for current and future search engine guests. To completely disable syslogd, a little bit more is necessary:

Completely disable syslogd

stop syslogd

service syslogd onestop

Uses the service command which has been with us since FreeBSD 7.3 (2012). It works for services in /etc/rc.d as well as /usr/local/etc/rc.d and is more finger friendly.
Using onestop instead of stop will stop syslogd even if these commands are run out of order.

disable syslogd

sysrc syslogd_enable=NO

That command does exactly what Igor instructs and appends a line to /etc/rc.conf which prevents syslogd from starting in the future. Sysrc appeared in FreeBSD 9.2 (2015). Previously, the same thing was usually accomplished with echo syslogd_enable=NO >> /etc/rc.conf.

disable newsyslog at boot

sysrc newsyslog_enable=NO

This command prevents newsyslog from running at boot time.

disable newsyslog at run time

sed -i .bak -e '/^0.*newsyslog/ s/^0/#0/' /etc/crontab

This sed command searches for the line that starts with a 0 and contains the word newsyslog. Then it inserts a # in front of the zero, disabling the newsyslog cron task. Now you won't get pesky emails from cron complaining that:

newsyslog: pid file doesn't exist: /var/run/syslog.pid

Is disabling syslogd a good idea?

EhevuTov makes a very good point that disabling syslogd to save disk space is probably not the best reasoning. However, there are some very good reasons one might want to disable syslogd.

Running FreeBSD in a jail with a process that handles its own logging (squid, nginx, etc.). If nothing in the jail uses syslogd, there's no gain in having it running.
Running thousands of jails on a FreeBSD host might make a different syslog architecture more sane (dropping log sockets into each jail (see syslogd -l)).
No. 2 holds even for handfuls of jails when centralized logging is desired. It avoids needing every jail configured with @host syntax for forwarding.
Numbers 2 & 3 are especially significant if you are also routing all the logs to external systems for indexing and archival. Syslog forwarding ends up making those use cases more complicated.
Using a different syslog daemon. If using an alternate syslog daemon, there's a good chance you want FreeBSD's stock syslog and all its assumptions and expectations completely disabled.

score 3 · Accepted Answer · answered Jul 31 '13 at 14:23

3

Stop the daemon:

/etc/rc.d/syslogd stop

Append a line to the /etc/rc.conf:

syslogd_enable="NO"

answered Jul 31 '13 at 14:23

Igor Hatarist

2,221

score 2 · Answer 3 · answered Jul 31 '13 at 18:39

Append a line to the /etc/rc.conf:

syslogd_enable="NO"

Stop the daemon:

/etc/rc.d/syslogd stop

However, I wouldn't recommend stopping syslogd. I recommend instead editing the size and frequency of your log rotation by editing your /etc/newsyslog.conf configuration file. It's very modifiable. You can comment out the services you don't want to follow with a # in the front of the row, or modify the:

count for max number of file archives
size for the size of each archive
when for when you want to rotate

There are a bunch of options that I would think could fit your situation. For instance, if you want to only keep a max kb size for your logs, you can do that. Surely you could spare a few kb for logs :-P Read the man newsyslog.conf for more detail on grooming the log system size you want.