# Suricata logging to console when syslog is enabled **URL:** \ **Category:** Help\ **Tags:** community, suricata\ **Created:** [December 4, 2024, 6:26pm UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103 "2024-12-04T18:26:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![toontje](https://avatars.discourse-cdn.com/v4/letter/t/b5e925/32.png) [@toontje](https://forum.suricata.io/u/toontje)\ **Post date:** [December 4, 2024, 6:26pm UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/1 "2024-12-04T18:26:20Z")
- Suricata version 6.0.10 - Operating system and/or Linux distribution “Debian GNU/Linux 12 (bookworm)” - How you installed Suricata (from packages) Whenever i enable syslog suricata starts logging to the console. Obviously this is not desirable. Outputs section suricata.yml: ```auto # Configure the type of alert (and other) logging you would like. outputs: # a line based alerts log similar to Snort's fast.log - fast: enabled: yes filename: fast.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: yes filetype: syslog #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json # Enable for multi-threaded eve.json output; output files are amended with # with an identifier, e.g., eve.9.json #threaded: false #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above identity: "suricata" facility: local0 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug #ethernet: no # log ethernet header in events when available #redis: # server: 127.0.0.1 # port: 6379 # async: true ## if redis replies are read asynchronously # mode: list ## possible values: list|lpush (default), rpush, channel|publish # ## lpush and rpush are using a Redis list. "list" is an alias for lpush # ## publish is using a Redis channel. "channel" is an alias for publish # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting should be reserved to high traffic Suricata deployments. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entries to keep in buffer ``` Logging section: ```auto logging: # The default log level: can be overridden in an output section. # Note that debug level logging will only be emitted if Suricata was # compiled with the --enable-debug configure option. # # This value is overridden by the SC_LOG_LEVEL env var. default-log-level: notice # The default output format. Optional parameter, should default to # something reasonable if not provided. Can be overridden in an # output section. You can leave this out to get the default. # # This value is overridden by the SC_LOG_FORMAT env var. #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- " # A regex to filter output. Can be overridden in an output section. # Defaults to empty (no filter). # # This value is overridden by the SC_LOG_OP_FILTER env var. default-output-filter: # Requires libunwind to be available when Suricata is configured and built. # If a signal unexpectedly terminates Suricata, displays a brief diagnostic # message with the offending stacktrace if enabled. #stacktrace-on-signal: on # Define your logging outputs. If none are defined, or they are all # disabled you will get the default: console output. outputs: - console: enabled: no # type: json - file: enabled: yes level: info filename: suricata.log # type: json - syslog: enabled: yes facility: local5 format: "[%i] <%d> -- " # type: json ``` When i disable syslog output the logging to console stops. What am i doing wrong? ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [December 5, 2024, 7:49am UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/2 "2024-12-05T07:49:22Z")
Hi! Welcome to our forum. 🙂 Please note that [Suricata 6 is now end-of-life (EOL) - Suricata](https://suricata.io/2024/08/01/suricata-6-is-now-end-of-life-eol/) Please upgrade to the latest stable version 7.0.7 and report if the issue persists. Thank you! ---
**Author:** ![toontje](https://avatars.discourse-cdn.com/v4/letter/t/b5e925/32.png) [@toontje](https://forum.suricata.io/u/toontje)\ **Post date:** [December 5, 2024, 10:16am UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/3 "2024-12-05T10:16:37Z")
Updated to 7.0.7 using packet manager from bookworm-backports. Still happening. ---
**Author:** ![toontje](https://avatars.discourse-cdn.com/v4/letter/t/b5e925/32.png) [@toontje](https://forum.suricata.io/u/toontje)\ **Post date:** [December 6, 2024, 2:48pm UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/4 "2024-12-06T14:48:07Z")
Ok, after lots of trying resolved. ---
**Author:** ![Mikaciu](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/mikaciu/32/3878_2.png) [@Mikaciu](https://forum.suricata.io/u/Mikaciu)\ **Post date:** [July 18, 2025, 9:07pm UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/5 "2025-07-18T21:07:22Z")
@toontje can you share what you did to remove console output ? ---
**Author:** ![dave](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dave](https://forum.suricata.io/u/dave)\ **Post date:** [February 20, 2026, 10:55pm UTC](https://forum.suricata.io/t/suricata-logging-to-console-when-syslog-is-enabled/5103/6 "2026-02-20T22:55:14Z")
Setting `level: Info` fixes it. Although i would recommend setting the following as a minimum: ```yaml outputs: - eve-log: enabled: yes filetype: syslog identity: suricata facility: local5 level: Info ```