How to remove syslog logging on Debian Buster


After installing asterisk package from stable repo on Debian Buster, I can observe Asterisk are both logged in /var/log/asterisk/messages and /var/log/syslog (and maybe other files)

My config is:
In /etc/rsyslog.conf:

First some standard log files. Log by facility.

auth,authpriv.* /var/log/auth.log
.;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

In /etc/asterisk/logger.conf:
console => notice,warning,error
messages => notice,warning,error

CLI > logger show channels
Logger queue limit: 1000

Channel Type Formatter Status Configuration

/var/log/asterisk/messages File default Enabled - NOTICE WARNING ERROR
Console default Enabled - NOTICE WARNING ERROR VERBOSE

  1. Is it correct that the line in rsyslog.conf that triggers addition to /var/log/syslog is the one bellow
    .;auth,authpriv.none -/var/log/syslog

  2. I think I prefer having them only logged into /var/log/asterisk/* files.
    How can I configure this ?

Best regards

Your configuration does not log Asterisk messages to syslog.

If you disable system messages from syslog, you may find it difficult to get support when things go wrong. Changing the syslog settings is a purely OS issue, as, as noted, you haven’t enabled the use of syslog for Asterisk generated messages.

By “[y]our configuration”, do you mean “the data in logger.conf” ?
If positive, could it be a compilation option, then ?
I would really appreciate to learn about that.

I agree logs are mandatory for many reasons (diagnosis, auditing, …).

Maybe, I should simply:

  • turn off logging in /var/log/asterisk files as duplicating messages can create issue (the other day, I had a 17GB log file)
  • learn to work with a file gathering logs coming from (too ?) many sources
  • learn to tune Asterisk to Syslog logging as it currently produces lines cluttered with color espace sequences

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.