Hi! I use Syncthing (docker image “syncthing/syncthing:latest”) and noticed that I lost 120GB of size on my SSD where stored all my containers.
Found that
/var/lib/docker/containers/<here_is_id_of_syncthing_container>/
File <here_is_id_of_syncthing_container>-json.log just increases size dramatically, it was 117GB, I removed it manually and see that after 1-2 minutes it is already 75MB.
How can I decrease size of this log or turn off it? Or setup limit for size?
It seems to me that you have turned on audit logging. It will log a lot. https://docs.syncthing.net/users/faq.html?highlight=conflict#how-can-i-view-the-history-of-changes
Opened description
The web GUI contains a
Global Changesbutton under the device list which displays changes since the last (re)start of Syncthing. With the-auditoption you can enable a persistent, detailed log of changes and most activities, which contains aJSONformatted sequence of events in the~/.config/syncthing/audit-_date_-_time_.logfile.
And do not see ‘Global Changes’ button on my GUI
And according to description FAQ — Syncthing documentation should be json log file
~/.config/syncthing/audit-_date_-_time_.log but I have only one log file
<here_is_id_of_syncthing_container>-json.log
Also, I have tried to add options to containers: ‘-logfile=-’ ‘-logflags=0’ but did not help and I do not see any information in FAQ — Syncthing documentation about size limitation of log file, it is stupid, because each soft has it. On windows 10 I use SyncTrayzor and there is option for log file and my syncthing.log ~ 127KB
This looks like docker creates this file to capture the console output of the container. The audit setting would also cause higher writes to the console so this is somewhat expected.
Do you know how to prevent this log?
For 2 hours it is already 740 MB
It is official image of Syncthing, I expected some explanation here on forum, workaround, or something.
For me solution now - execute next command after container starts
find /var/lib/docker/containers/<here_is_id_of_syncthing_container>/<here_is_id_of_syncthing_container>-json.log -delete
And log file will not be created till next container restart.
I don’t think this does what you think it does. Sure, this deletes the file from the filesystem so it’s inaccessible, but it will still consume space if it’s open and being written to.
You need to modify your docker setup not to launch syncthing with audit flag.
I have no idea, I am not familiar with whatever system is being displayed in your screenshots.
Based on the flags it should not produce audit logs, but perhaps you have some debugging environment variables set that increase the amount of logs syncthing produces.
I’d check the actual content of the logs and see what it contains.
It is Portainer, I use it for manage containers.
If you really know you can show me how to stop audit log in docker compose file or any other options, let`s imagine that I do not have Portainer.
The problem is not in my setup, problem that nobody knows where is audit log setup and how to stop it, but a few persons mentioned it… Strange to hear that from ’ Syncthing Maintainer’ members 
My env variable
LabelsFound solution
docker run –log-driver none syncthing/syncthing:latest or docker run –log-driver local syncthing/syncthing:latest
That’s a workaround. Could you check if its really the audit log which is spamming here:
docker logs your_container_nameI don’t see anything here to indicate this is audit related. Or possibly even Syncthing related. But as mentioned, why not take a look at the log in question instead of laughing at the people trying to help.
Ok, I was wrong, do not pay attention to my mood, sorry if I offended you, issue related to docker container itself, by default Syncthing will be created with full log. I would add –log-driver none or local for documentation OR if someone uses Portainer there is simple option on UI
Regular logging shouldn’t generate so much output. Check the docker log and you’ll find the culprit 
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
