Arch Linux

ElDani

Member

Registered: 2019-06-18

Posts: 6

Disable systemd logging for a service

Hi.

I've already done this for a daemon that runs as a non-root user, because the daemon is incredibly verbose and has no other option to be silenced. Instead of calling the binary directly, I'm using the following bash script as a minimal wrapper:

#!/bin/bash
killall application 2> /dev/null
echo "Starting application ..." | systemd-cat --identifier="application" --priority=5
/usr/bin/application > /dev/null 2>&1
echo "Application has shut down." | systemd-cat --identifier="application" --priority=5

I'm unsure if this is the best method of doing this, but it's the most simple one I could think of. Since I don't need any debug output of that application (there are separate logs available), this has been working well for me.

Today however I was forced to install a cron daemon to give users with shell access the same option I could set up with root access using systemd. In addition to that, crontabs are easier to set up with different repetition configurations anyway.

My choice in this was chronie because I know it from a different distribution and it works like a charm on Arch as well, with only a single exception. crond by default keeps filling my systemd journal with too much useless information. Every time a cronjob is executed, 4 lines are added to the journal, 3 from crond and one which is a kernel audit for the user session that is being opened. This is a bit of a worry, because I'm expecting at least 30-40k low-effort executions per day.

Having had a look at the crond man-page, it seems to use the default -s parameter, but the cronie.service file only contains the command "/usr/bin/crond -n". Since the documentation doesn't mention disabling logging at all and also misses some other parameters I've found with a google search (ie. "-L 0" to set verbosity level to zero), I'm back to the wrapper script idea.

What should I do to reduce unnecessary journal spam in this situation? Does it matter if I keep a bash script like the one above running as a root user as opposed to a non-root user? That still wouldn't get rid of the audit messages though. What are they about and does it have a security impact to get rid of them, which would be by disabling systemd-journald-audit.socket I assume?

Thanks for any help.

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,423

Re: Disable systemd logging for a service

For general units see https://www.freedesktop.org/software/sy … ardOutput=

For information on the audit framework read: https://wiki.archlinux.org/index.php/Audit_framework whether or not you want this disabled is up to you. As mentioned in the article, by itself it doesn't add anything to security inherently, it will help you trace things if necessary.

ElDani

Member

Registered: 2019-06-18

Posts: 6

Re: Disable systemd logging for a service

Thanks for your reply.

The information about the audit in the article was helpful and I've disabled it (for now).

What I couldn't get rid of is the journal logging of the cron daemon of the cronie package. Unless I miss my guess, the daemon logs directly to the journal, at least that's my assumption after seeing no success with any of the methods to reroute stdout/err.in the systemd service configuration to null respectively /dev/null.

loqs

Member

Registered: 2014-03-06

Posts: 19,101

Re: Disable systemd logging for a service

https://github.com/cronie-crond/cronie/ … ron.c#L303 ?

ElDani

Member

Registered: 2019-06-18

Posts: 6

Re: Disable systemd logging for a service

Yes exactly!

A quick look-through the source code has shown me here, that unless I use a non-empty MAILTO variable, it will always activate logging (directly) to the syslog.

The only other relevant thing I found regarding the disabling of logging is here, which seems to be a per-crontab switch that only works when the user is privileged. But does it apply to the user that runs the daemon or of the cronjob owner? I'll try to test that next.

Edit: I was thinking of just leaving the tens of thousands of journal lines and cleaning up all the crond entries periodically with a crontab, but that's not supported (or at least not officially supported) according to the replies over at StackExchange. Neither does the journalctl command allow exclusion/negative filtering, not without jumping through some hoops.

Last edited by ElDani (2019-08-06 17:03:05)