Silence the Endless “dhclient” Logs in Systemd’s Journal with a One‑Line syslog.d Rule

The Problem

dhclient is the classic DHCP client on most distributions.
When a network interface comes up, it writes a line for every lease request, renewal, and release. On a busy server or in a homelab with multiple interfaces, those lines can fill the journal within minutes, making journalctl -b noisy and slowing down log‑based monitoring.

Why It Matters

Log Volume – A full journal consumes disk space and can trigger automatic rotation or deletion, potentially discarding useful diagnostics.
Performance – Writing thousands of lines per boot can add a few milliseconds to the boot time, which matters for high‑availability systems.
Security – While the messages themselves are harmless, a cluttered journal can mask real events, and excessive logging can expose sensitive data if the logs are forwarded to an insecure remote collector.

The One‑Line Solution

Systemd’s syslog.d directory lets you filter messages before they reach the journal. A single rule is enough to silence all dhclient output:

sudo tee /etc/systemd/syslog.d/50-dhclient.conf <<EOF
SYSLOG_IDENTIFIER=dhclient
SYSLOG_PRIORITY=0
EOF

SYSLOG_IDENTIFIER=dhclient matches only messages whose SYSLOG_IDENTIFIER field equals “dhclient”.
SYSLOG_PRIORITY=0 drops every message that matches the filter.

The rule file must be owned by root and readable by the system. The numeric priority 0 is interpreted by systemd-journald as “drop this message”.

Reloading Journald

After adding the rule, reload the daemon so the new filter takes effect:

sudo systemctl restart systemd-journald

Verify that the filter works:

journalctl -u dhclient
# → No output

If you still see messages, double‑check the file’s path and spelling.

Trade‑offs & Caveats

Missing Diagnostics – A dropped log stream means you won’t see failed lease attempts or misconfigurations. If you suspect a DHCP issue, temporarily remove the rule or set SYSLOG_PRIORITY=info to keep only informational messages.
Other Services – The rule only affects dhclient. Other network tools (e.g., systemd-networkd) still log normally.
Persistency – The rule survives reboots and package upgrades, but if a distribution changes the default SYSLOG_IDENTIFIER string, you’ll need to adjust the rule.

Security Perspective

Silencing dhclient logs reduces the amount of data that could be exposed if logs are forwarded to a remote syslog server. However, the logs also provide an audit trail of network changes, which can be valuable for compliance or forensic investigations.