RSS Feed

Turning Off Logging

Created: 01.10.2020


From Apple’s official documentation:

In some cases, the contents of a volume are sufficiently secret that it is not appropriate to log them. To disable logging on a per-volume basis (for creating a backup volume, for example), you must do the following:

  • Create a .fseventsd directory at the top level of the volume.
  • Create an empty no_log file in that directory.

So if your volume is mounted at /Volumes/MyDisk, you would create an empty file called /Volumes/MyDisk/.fseventsd/no_log.



Switched to “No auditing” will disable logging of these events.


syslog is system wide, so you can’t disable syslog on a per session basis.

However, you can

  • copy /etc/rsyslog.conf to /tmp/rsyslog.conf
  • edit /tmp/rsyslog.conf to remove unwanted logging
  • kill rsyslogd (/etc/init.d/rsyslogd stop)
  • run rsyslogd -d -f /tmp/rsyslog.conf for the time of your “session”

at the end of the session

  • kill rsyslogd (find process with ps)
  • run rsyslog (/etc/init.d/rsyslogd start)


[1] Disable logging to syslog, Starkexchange

[2] Windows – How to disable Windows 10 system log

[3] Preventing File System Event Storage on macOS