# df -h  | grep log
armbian-ramlog   50M  5.7M   45M  12% /var/log

# ls -lha /var/log | grep -e syslog -e message
drwxrwxr-x 11 root syslog  660 Aug 11 22:26 .
-rw-r-----  1 root root      0 Aug 11 22:15 syslog

# systemctl status syslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2019-08-11 22:25:49 CEST; 9min ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 1042 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─1042 /usr/sbin/rsyslogd -n

Aug 11 22:25:49 opi-06-app-c13 systemd[1]: Starting System Logging Service...
Aug 11 22:25:49 opi-06-app-c13 systemd[1]: Started System Logging Service.

# ls -lha /var/log.hdd/ | grep -e syslog -e message
drwxrwxr-x 11 root syslog 4.0K Aug 11 22:25 .
-rw-r-----  1 root root      0 Aug 11 22:15 syslog
-rw-r-----  1 root root    28M Mar  4 06:25 syslog.1
-rw-r-----  1 root root   212K Mar  3 06:25 syslog.2.gz
-rw-r-----  1 root root   2.9M Mar  2 06:25 syslog.3.gz
-rw-r-----  1 root root   1.9M Mar  1 06:25 syslog.4.gz
-rw-r-----  1 root root   791K Feb 28 06:25 syslog.5.gz

 

it probably worked at some point ... forgot what I did to break it ...

It's a permission issue, with: 

chmod -R 777 /var/log

Syslog started to fill up. Same thing with mongodb and many other daemons. Few apt-updates ago I didn't have this problem but I still don't know what caused the issue...maybe log2ram...

Yes, much better:

 

# ls -lha /var/log | grep -e syslog -e message
drwxrwxrwx 11 root syslog  660 Oct 19 19:46 .
-rwxrwxrwx  1 root root   6.7K Oct 19 20:43 syslog

Thanks