# Build it yourself · Part 1

## Chapter 7: Logs that forget

> Markdown copy of https://kuuko.app/build/logs/ for agents; the HTML page is the source. Part 1 of Kuuko's guide to building the core yourself. Text: CC BY-SA 4.0 · Commands and configs: CC0.

*Checked: 30 October 2026*

---

### Why

Your resolver already keeps no record of the names you look up (chapter 4). But the server itself writes logs: every SSH attempt, every service start, often with IP addresses. Ubuntu keeps those on disk with no time limit by default. A "no logs" promise is only true if it's true on the server, so this chapter makes the system log live in memory only, and forget within a day.

### What you need

- The server from chapter 3.
- About 15 minutes (our estimate).

### Steps

All on the server.

#### 1. The system log in memory only, under 24 hours

```
sudo install -d -m 0755 /etc/systemd/journald.conf.d
sudo nano /etc/systemd/journald.conf.d/zz-privacy.conf
```

Paste:

```ini
[Journal]
Storage=volatile
RuntimeMaxUse=64M
MaxRetentionSec=22h
MaxFileSec=1h
ForwardToSyslog=no
```

What each line does:
- `Storage=volatile`: the log lives in memory (`/run/log/journal`) and is gone after a restart.
- `RuntimeMaxUse=64M`: at most 64 MB of memory for it.
- `MaxRetentionSec=22h`, `MaxFileSec=1h`: the log is cut into one-hour pieces, and pieces older than 22 hours are deleted. So nothing is older than about a day.
- `ForwardToSyslog=no`: nothing is passed on to the classic log files.

**Why the name starts with `zz-`:** settings files are read in alphabetical order, and the last one wins. Ubuntu ships its own file, `syslog.conf`, that turns `ForwardToSyslog` back on. Yours must sort after it.

#### 2. Switch off the classic log files

`rsyslog` writes `/var/log/syslog` and `/var/log/auth.log`, which keep growing on disk. Switch it off for good:

```
sudo systemctl disable --now rsyslog.service || true
sudo systemctl stop syslog.socket || true
sudo systemctl mask rsyslog.service syslog.socket
sudo systemctl restart systemd-journald
```

- `mask` makes sure no update or other program can start it again.
- `|| true`: if your Ubuntu doesn't have rsyslog installed, the first two lines print an error. That's fine; carry on.

#### 3. Delete what was written before

This can't be undone:

```
sudo rm -rf /var/log/journal
sudo rm -f /var/log/syslog /var/log/syslog.* /var/log/auth.log /var/log/auth.log.* \
           /var/log/kern.log /var/log/kern.log.*
```

### How you know it worked

1. **Your setting wins:**

   ```
   systemd-analyze cat-config systemd/journald.conf | grep -E '^ForwardToSyslog='
   ```

   The **last** line shows `ForwardToSyslog=no`.

2. **The log is in memory, not on disk:** `/run/log/journal` exists, `/var/log/journal` doesn't:

   ```
   ls -d /run/log/journal /var/log/journal
   ```

   shows the first, and "No such file or directory" for the second.

3. **No classic log files come back:**

   ```
   ls /var/log | grep -E 'syslog|auth.log'
   ```

   shows nothing, also after a day.

4. **The log still works:**

   ```
   logger -t privacy-check "test" && journalctl -t privacy-check -n 1
   ```

   shows your test line.

5. **After a day, nothing is older than a day:**

   ```
   journalctl --no-pager -o short-iso | head -3
   ```

   The first entries shown are the oldest, and their time is less than 24 hours ago.

### Pitfalls

- **Ubuntu's own `syslog.conf` turns forwarding back on**, and is read after a file named `90-…`. Our first file was named that way and lost. Always check which setting wins (check 1).
- **sshd logs every scanner, if it can see them.** Bots try to log in to every server on the internet, and each attempt is logged with its address. The firewall from chapter 3 keeps them out, but only if it's attached. Before ours was, the log filled up within hours.
- **No Fail2ban.** It's a popular tool against those bots, but it keeps lists of IP addresses. The firewall already keeps SSH closed to everyone but you.
- **Login records are kept separately.** Ubuntu also keeps a record of logins (the `last` command shows it), outside this log. With the firewall in place it holds only your own SSH logins.

### Time and cost

- About 15 minutes (our estimate).
- Free.

---

Previous: [Chapter 6: Block lists that update themselves](https://kuuko.app/build/block-lists/) · Next: [Chapter 8: Your iPhone and Mac](https://kuuko.app/build/devices/)

Text: CC BY-SA 4.0 · Commands and configs: CC0