My solution for Raspbian 8.0 (Jessie) based on logging to RAM
There already exists the Ramlog Debian package and installation instructions for this. However, this didn't work for me (Starting ramlog-tmpfs 2.0.0: Error: /var/log is in use... [fail]).
iotop -bktoqqq I figured out most frequent write access. It turns out that also /var/cache/samba/ is frequently written to. So this also has to go to RAM in addition to /var/tmp/ where the new log files will be.
1. Creating the ramdisk
So first these two entry have to be added to
tmpfs /var/tmp tmpfs size=10M,nodev,nosuid 0 0
tmpfs /var/cache/samba tmpfs size=5M,nodev,nosuid 0 0
2. The log2disk script
We need to save this script in
/usr/local/bin/log2disk which will append and delete the contents from all log files in
/var/tmp/log/ to the files in
# Author: Frank Breitling <firstname.lastname@example.org>
DESC="Moving contents from /var/tmp/log/ to /var/log/"
if [ $(id -u) -ne 0 ]
then echo "Please run as root"
exec >>/var/log/log2disk.log 2>&1
for i in log/*; do
cat $i >>/var/$i
and make it executable
sudo chmod +x /usr/local/bin/log2disk.
3. Adding to crontab
We want to run this script every 3 hours and add this line to the system's
10 */3 * * * root /usr/local/bin/log2disk
(Don't forget a final newline which is needed by crontab.)
4. Installing the log2disk.service
We need to create a systemd service in
/lib/systemd/system/log2disk.service that executes this script before shutdown and reboot, so that the log file contents gets preserved:
Description=Write log files to disk
and install it with
sudo systemctl enable log2disk.
5. Selecting the log files for RAM
Now we can tell
/etc/rsyslog.conf which logfiles to keep in RAM. These files are
auth.log, syslog, daemon.log, user.log and messages and we replace for each of their entries the
log/ path by
tmp/log/ for example like this:
After a reboot, the system will now log the most frequent log entries to
/var/tmp/log and sync them back every 3 hours and before shut down.
We can use
iotop again to find a significantly reduced write activity.
However we should not be worried about the green ACT LED flashing. Apparently this is not a good write access indicator.