get rid of journal on systemd-using systems?

[lorenzo]

On Tue, 20 Jun 2023 22:05:17 +0200 (CEST)
Thorsten Glaser <t.glaser at tarent.de> wrote:

> Ciao Lorenzo,
> 
> >I think mask + disable + stop the journald service, and unmaks +
> >enable +start your syslog daemon should do it. But then there is an
> >issue:
> 
> what commands exactly would one use for this?
[not tested]

systemctl mask systemd-journald.service
systemctl stop systemd-journald.service
systemctl disable systemd-journald.service

should do it; anyway, by reading some stackexchange page[1], you may
also need to check that /dev/log is a real socket (not a symlink to
journald socket), make your logger's service require the /dev/log
socket and finally make sure your logger is configured to write
somewhere under /var/log/ and not to forward all messages to journald..

[1]
https://unix.stackexchange.com/questions/704833/how-can-journald-be-disabled

> 
> I guess someone’ll have to fire up a VM to test this…

I'm afraid so (and I'm not volunteering for this)

Lorenzo

> 
> >if I recall correctly journald catches stdout from services, so you
> >may loose some output from systemd itself and you loose all logs
> >from a service if it's called with an option to log to stdout.
> 
> Last time I looked into udev spewing the kernel log full with
> its stuff, I encountered a generic-ish logging layer in systemd
> which seems to test for presence of journald and depending on
> that uses journald-with-klog-fallback or syslog-with-klog-fallback
> (udev is started too early for syslog, and it’s not restarted in
> rc2, so it goes to klog), so that might even work. I don’t know.
> 
> bye,
> //mirabilos