Stop systemd from restarting rsyslog

Use systemctl stop rsyslog.service when you want systemd to stop the service. Killing the process directly can trigger its configured restart policy. There is no universal systemd rule that rsyslog must restart: the installed unit and its overrides determine that behavior.

Inspect the effective service configuration

systemctl cat rsyslog.service
systemctl show rsyslog.service -p Restart -p TriggeredBy
systemctl status rsyslog.service

Look for Restart=, drop-ins, socket activation, and other units that can request a start. A disabled service can still be started manually or through dependencies.

Change automatic restart behavior

To prevent restart-policy-driven retries, create an override:

sudo systemctl edit rsyslog.service

Enter:

[Service]
Restart=no

Then apply it during an appropriate logging maintenance window:

sudo systemctl daemon-reload
sudo systemctl restart rsyslog.service

A deliberate stop through systemd does not trigger Restart=always. Details such as successful exit statuses and restart limits are covered in systemd.service.

Disable or mask when that matches your intent

sudo systemctl disable --now rsyslog.service

This stops the running service and removes its enablement links. It does not prohibit all future starts. If a dependency or socket keeps activating it, inspect that activation path.

For a stronger administrative block:

sudo systemctl mask --now rsyslog.service

A mask prevents systemd from starting the unit, including dependency and manual starts. It does not prevent someone from executing rsyslogd directly. If a local unit file prevents masking, inspect its origin before changing it. Undo the mask with systemctl unmask rsyslog.service; restore enablement separately if required.

Account for the logging impact

On a systemd host, journald may continue recording messages it receives, but that does not replace every rsyslog input, file destination, or remote forwarding route. Check journal persistence and affected log consumers before stopping the service.

Use rsyslogd -N1 for a configuration syntax check without launching a second daemon. A service restart interrupts processing briefly; it is not merely a configuration inspection. Keep overrides under /etc/systemd/system/ rather than editing packaged files that an upgrade can replace.