My equipment is an OrangePi PC Plus with ARMBIAN 5.6, packages and system updated.

I have seen that the /var/ log directory mounted as zram is reaching its space limit in a few days.
To resolve, I edited the /etc/logrotate.d/rsyslog file and put the following:

/var/log.hdd/syslog
{
        rotate 1
        10M size
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate> / dev / null
        endscript
}

/var/log.hdd/mail.info
/var/log.hdd/mail.warn
/var/log.hdd/mail.err
/var/log.hdd/mail.log
/var/log.hdd/daemon.log
/var/log.hdd/kern.log
/var/log.hdd/auth.log
/var/log.hdd/user.log
/var/log.hdd/lpr.log
/var/log.hdd/cron.log
/var/log.hdd/debug
/var/log.hdd/messages
{
        rotate 1
        size 1M
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate> / dev / null
        endscript
}

First, i manually executed logrotate to test, and nothing happened in /var/log.

I tried editing the logrotate file to change the /var/log.hdd directory to /var/log but when the system is restarted, it returns to log.hdd.

I want to know how to solve this.

I would like to disable zram and mount /var/log as tmpfs. In fstab I did not find an entry for /var/log, so I created one with the tmpfs format.

Still while giving the command "df" I realized that / var / log is still mounted as zram.
What is the way to change or disable zram?

Reason why /var/log is filling up is because if you review df -h, you'll find that /var/log is mapped to zram...

 

Logrotate might not hit the time limits in the fs time as each time with current zram-config in armbian, it's mapped to an ephemeral state over in zram - ask @tkaiser why this is what it is - his script that does this... my guess his intend with /var/log is to reduce read/write on flash there, and that's fair enough...

 

Things in /tmp are ok to be free and mapped to tmpfs - things in /var, even /var/tmp are expected to remain constant across boots, but that's just my opinion.

 

My opinion and two bucks will buy you a cup of coffee at the local *bucks...

 

zram is a good thing actually - and tmpfs plays into that, as tmpfs is ram...

 

 

Anyways - if one is writing to /var/log, and still running into problems with space - even on a small mem footprint - need to explore why so much logging...

 

Case in point... this is my jumpbox into my lan - and we're writing /var/tmp to flash, and it's not that big of a deal at first glance...

$ sudo du -h /var/log
4.0K	/var/log/samba
4.0K	/var/log/sysstat
32K	/var/log/lightdm
180K	/var/log/apt
2.8M	/var/log

This is 6-months worth of use on that box... the 2.8M is a bit misleading, as it's active all the time, and writes to flash have a cost there there, as each write to flash is also an erase cycle, and on poor quality cards, this can lead to early failure - and small cards are more at risk than larger cards...

 

I'll defend the decision to some degree - @tkaiser's script has to assume many things - size of the flash, quality of the flash...

On 10/3/2018 at 5:42 PM, JonatasPrust said:

I would like to disable zram and mount /var/log as tmpfs. In fstab I did not find an entry for /var/log, so I created one with the tmpfs format.

Still while giving the command "df" I realized that / var / log is still mounted as zram.
What is the way to change or disable zram?

 

Hint - it's a feature mention within the armbian-zram-config script set - it calls armbian-ramlog

 

Look at /etc/default/armbian-ramlog - you can change "enabled" to false, and then things start follow expected rules... and you can mount /var/log where ever you want... remember you need to be root or sudo to do this, and reboot after the change.