Hello,

 

I have a few small questions:

• Cubietruck with latest Armbian
• Two log folders, /var/log and /var/log.hdd, the first kept in RAM that's regularly copied to the SD-Card, keeping the wear of the SD small
• This used to work flawlessly, I don't know when this changed

Lately I realized that the RAM-disk is flooded very quickly by something that is writing to /var/log/journal/random_hex_number/ until it runs OOM. Almost all other logs are empty, likely because a lot more gets written to the journal log. Unfortunately the content of all files in the journal subfolder contain binary data, the only commonality I see is that all files start with "LPKSHHRH". So I'm unable to find out what daemon is writing to them, why it is writing that much and if this has a reason. If I delete these log files it gets recreated. So my questions are:

• How to find out who is writing to that folder?
• Why does so much get written?
• Is it important what is logged there? If I can't see everything I would prefer to see what should get written to the other log files, instead of big files in journal, that might be of little value.

 

Any idea what's wrong here and what could be done to stop it?

Here are a few hints how to tweak journal: https://askubuntu.com/questions/1238214/big-var-log-journal

This might be a solution! I'll wait for some time to see if the flooding has gone away and afterwards mark your answer as solution.

This seems to work, however on Armbian you need to set SystemMax... and RuntimeMax... as well (likely because it's logging to a RAM-disk first). Then it does have the desired effect.