1

The logging in systemd's journal is getting spammed by logging from dhcpd.

I am running isc-dhcp-server and would like to prevent the log ending up in the journal, and instead go to its own file.

I had a similar issue with apparmor, but that was rectified by installing auditd which reroutes the logs for me.

Is there an equivalent for doing this for dhcpd logs?

OS: Ubuntu 22.04

dhcpd: 4.4.1-2.3ubuntu2.3

UPDATE

What I tried:

Add to /etc/dhcp/dhcpd.conf

log-facility local7;

And add to /etc/rsyslog.d/50-default.conf

local7.* /var/log/dhcpd.log

But all this accomplished was doubling the logging to 2 different destinations. I want the logs to the /var/log/syslog to stop and only log to /var/log/dhcpd.log destination.

Bram
  • 3,919
  • 5
  • 39
  • 59

1 Answers1

0

At the very bottom of 50-default.conf, you should have the following lines:

# comment out the following line to allow messages through. Doing so
# means you'll also get messages in /var/log/syslog
& stop

If you don't, add and restart rsyslog.

Obit
  • 21
  • I added those lines, and did systemctl restart rsyslog but I still get the log entries in both the dhcpd log and the syslog. – Bram Oct 01 '23 at 02:21
  • Try adding local7.none to catch-all filter:

    *.*;auth,authpriv.none;kern.none;mail.none;cron.none,local7.none -/var/log/syslog

     – Obit Oct 24 '23 at 00:35
  • I think it is slowly getting there... they stopped appearing in syslog, but still show up in journalctl output? – Bram Dec 02 '23 at 20:11