Datadog-agent: No way to disable syslog output

[pvalsecc]

Describe what happened:

I've tried several ways to disable log output to syslog, but found nothing that works. Looking at the code, there should be a way to disable them using the log_to_syslog config option to false or something but I still have logs in /var/log/syslog coming from the agent.

Describe what you expected:

Only logs in /var/log/datadog/

Steps to reproduce the issue:

Try to disable syslog output.

Additional environment details (Operating System, Cloud provider, etc):

Linux Ubuntu 18.10 rc with datadog-agent 6.1.3-1.

[olivielpeau]

Hi @pvalsecc!

On Ubuntu 18.10, the Agent is orchestrated by systemd. On your environment, systemd's journal may be configured to forward the standard output and standard error of all systemd services to syslog (actually I _think_ that's the default behavior on Ubuntu). That's probably why you're still seeing logs from the Agent in /var/log/syslog even though the Agent process itself doesn't log to syslog directly.

System level

At the system level, you can set ForwardToSyslog=no in /etc/systemd/journald.conf (and then reload systemd's config, sudo systemd daemon-reload) to disable this behavior.

Service level

If you don't want to change that system-level setting, I think your only solution is to disable sending the Agent process(es) stdout to journal. This may not be ideal as you'll also stop storing the agent service logs and errors in journald. To do that, add this under the [Service] section of the Agent service(s), by setting:

StandardOutput=null

For reference see https://www.freedesktop.org/software/systemd/man/systemd.exec.html#StandardOutput=

The agent service files are datadog-agent.service ("main" agent), datadog-agent-trace.service (trace agent) and datadog-agent-process.service (process agent). They're located under /lib/systemd/system/. To make changes on the service configs, I'd recommend using the "drop-in" directories in /etc/systemd/system/<service_name>.d/. See https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Description for reference on that.

Hope this helps! Let us know if this solves your issue.

[pvalsecc]

Works like a charm. I had to edit the config for the 3 services though.

Thanks

[eldy]

This is how i did:
into datadog.yaml, i set
log_to_syslog=false
but also
log_to_console=false

Logs is still done into /var/log/datadog/*.log files but no more in syslog.

[arslan70]

This is how i did:
into datadog.yaml, i set
log_to_syslog=false
but also
log_to_console=false

Logs is still done into /var/log/datadog/*.log files but no more in syslog.

This doesn't work for me unfortunately

[vjcalel]

@olivielpeau Systemd only start/stop services. It has nothing to do with where the application wants to send the log. Lots of other services like graylog, postgres, ufw also uses journald but at the same offers to log into a specific file/folder /var/log/.

Please implement the feature. Stopping journald logs means you won't get important logs from kernel which is not acceptable.