log2ram writes files from ramdisk to sdcard every hour (if they are updated) by cron task. Also at startup log2ram loads all content from /var/log.hdd to ramdisk.
1. For improving situation with full ramdisk you can organize log rotation rules in /etc/logrotate.d to optimize logs by size. Log rotation is time dependent - daily, weekly. But, using log2ram, the best choice is to make it size-dependent.
edit /etc/logrotate.d/rsyslog:
/var/log/syslog
{
# rotate only once
rotate 1
# rotate only if syslog > 10 Mb
size 10M
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
/var/log/kern.log
{
# do not rotate, just purge file
rotate 0
# if size more than 1 Mb
size 1M
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
2. If your system spams a lot of messages, you can make log rotation more aggressive:
move /etc/cron.daily/logrotate to /etc/cron.hourly/logrotate
3. If you don't need detailed archived logging. You can protect your sdcard from hourly writes by telling log2ram to not write syslog and kern.log to disk. As a bonus at boot your ramdisk will not be filling with previous session's logs.
a) activate rsync mode in /etc/default/log2ram (or in /etc/log2ram.conf):
USE_RSYNC=true
b) find your log2ram (delete duplicates, if there is) and edit
whereis log2ram
replace two lines
rsync -aXWv --delete --links $RAM_LOG/ $HDD_LOG/ 2>&1 | $LOG_OUTPUT
and
rsync -aXWv --delete --links $HDD_LOG/ $RAM_LOG/ 2>&1 | $LOG_OUTPUT
with
rsync -aXWv --delete --delete-excluded --exclude-from '/etc/log2ram-exclude' --links $RAM_LOG $HDD_LOG 2>&1 | $LOG_OUTPUT
and
rsync -aXWv --delete --delete-excluded --exclude-from '/etc/log2ram-exclude' --links $HDD_LOG $RAM_LOG 2>&1 | $LOG_OUTPUT
c) create new file /etc/log2ram-exclude and add lines:
/log2ram.log
/syslog*
/kern.log*