# Prevent logging to /var/log/messages

**URL:** <https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199>\
**Category:** Elasticsearch\
**Created:** [June 28, 2016, 8:08pm UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199 "2016-06-28T20:08:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![djmcgreal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djmcgreal/32/52956_2.png) [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\
**Post date:** [June 28, 2016, 8:08pm UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/1 "2016-06-28T20:08:13Z")

</div>

Hi all Elasticsearchers,  
Is it possible to prevent logging to /var/log/messages? The /var/log/elasticsearch logs are sufficient and logging to /v/l/m is causing us some bother.

Thanks, Dan.

We're using RHEL and the RPM installation.

---

<div class="post-metadata">

**Author:** ![dude04](https://avatars.discourse-cdn.com/v4/letter/d/96bed5/32.png) [@dude04](https://discuss.elastic.co/u/dude04)\
**Post date:** [July 13, 2016, 12:34am UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/2 "2016-07-13T00:34:46Z")

</div>

I'm also looking for the same answer. Any guidance is appreciated.

---

<div class="post-metadata">

**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\
**Post date:** [July 13, 2016, 7:10am UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/3 "2016-07-13T07:10:38Z")

</div>

Elasticsearch is not logging to /var/log/messages.

Maybe you can shed some light by showing the log messages you want to get suppressed?

---

<div class="post-metadata">

**Author:** ![djmcgreal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djmcgreal/32/52956_2.png) [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\
**Post date:** [July 13, 2016, 7:48am UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/4 "2016-07-13T07:48:57Z")

</div>

> [@jprante](#):
>
> Elasticsearch is not logging to /var/log/messages.

And yet, `grep elastic /var/log/messages*`: [http://pastebin.com/u5Jx4rdQ](http://pastebin.com/u5Jx4rdQ)  
You can see that Kibana is also logging here.

I'm no expert. Something to do with syslog?

---

<div class="post-metadata">

**Author:** ![djmcgreal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djmcgreal/32/52956_2.png) [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\
**Post date:** [July 13, 2016, 12:08pm UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/5 "2016-07-13T12:08:40Z")

</div>

Probably this: [https://github.com/elastic/elasticsearch/issues/17220](https://github.com/elastic/elasticsearch/issues/17220)

---

<div class="post-metadata">

**Author:** ![dude04](https://avatars.discourse-cdn.com/v4/letter/d/96bed5/32.png) [@dude04](https://discuss.elastic.co/u/dude04)\
**Post date:** [July 21, 2016, 10:14pm UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/6 "2016-07-21T22:14:39Z")

</div>

I decided to rely purely on the logging file configured in elasticsearch.yml and disable elastic logging to the system journal. This can be achieved by:

Take a backup and make the changes:  
`[root@server ~]# diff /usr/lib/systemd/system/elasticsearch.service.bak /usr/lib/systemd/system/elasticsearch.service
< StandardOutput=journal
< StandardError=inherit
----
> #StandardOutput=journal
> #StandardError=inherit
> StandardOutput=null
> StandardError=null`

Reload the service definition and ensure it's loaded as expected:  
`[root@server ~]# systemctl daemon-reload
[root@server ~]# systemctl cat elasticsearch.service | grep Standard
#StandardOutput=journal
#StandardError=inherit
StandardOutput=null
StandardError=null`

Restart the service:  
`[root@server ~]# systemctl restart elasticsearch`

---

<div class="post-metadata">

**Author:** ![djmcgreal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djmcgreal/32/52956_2.png) [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\
**Post date:** [July 22, 2016, 9:34am UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/7 "2016-07-22T09:34:38Z")

</div>

Thanks. I’d been looking in /etc/init.d for similar (having found nothing in /etc/systemd/  
Dan.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:33pm UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199/8 "2017-07-05T22:33:26Z")

</div>