How to Change the Default Log Directory (/var/log) for rsyslog

Updated: 28 September 2026 · Applies to: rsyslog 8.2x on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

Logs normally live in /var/log. If that disk is small, or logs must be kept on a separate disk, there are two ways to move them: point rsyslog's log files to another folder, or put the whole /var/log on another disk. The second is usually simpler and keeps every program working, because paths do not change.

Option 1: put /var/log on a bigger disk (recommended)

1. Prepare a file system on the new disk and mount it temporarily, for example on /mnt/newlog (see how to partition and mount a new disk).
2. Stop the services that write logs, or do this in rescue mode, then copy the logs with all permissions and labels:

   systemctl stop rsyslog
   rsync -aAX /var/log/ /mnt/newlog/

3. Mount the new disk on /var/log through /etc/fstab, using its UUID, then unmount the temporary mount point and run mount -a.
4. Restore SELinux labels (AlmaLinux, Rocky Linux, RHEL): restorecon -Rv /var/log
5. Reboot, so every service reopens its log files on the new disk.

Option 2: write rsyslog's files somewhere else

1. Create the new folder:

   mkdir -p /data/logs

2. On AlmaLinux, Rocky Linux and RHEL, tell SELinux to treat it like /var/log:

   semanage fcontext -a -e /var/log /data/logs
   restorecon -Rv /data/logs

3. Change the file paths in /etc/rsyslog.conf (and files in /etc/rsyslog.d/), for example:

   *.info;mail.none;authpriv.none;cron.none   /data/logs/messages
   authpriv.*                                 /data/logs/secure

   On Ubuntu and Debian the main entries are in /etc/rsyslog.d/50-default.conf.
4. Check and restart: rsyslogd -N1 && systemctl restart rsyslog
5. Update log rotation: change the paths in /etc/logrotate.d/rsyslog to the new files, or rotation stops for them.

Option 2 only moves rsyslog's files. The systemd journal (/var/log/journal) and applications that write their own logs (web servers, databases) keep using their own paths.

Check

logger "log location test"
tail -n 3 /data/logs/messages

Official documentation: rsyslog actions and semanage-fcontext manual page.