A common worry of Raspberry Pi users is the wearing out and destruction of their SD card (which have limited write cycles) by too many writes. The experience reported by users supports this assumption.
Logging is one source of frequent write access.
So the question arises how this can be reduced on Raspbian.
If you are not interested in the logs you can switch a lot off using a log configuration setting.
Edit the file /etc/rsyslog.conf and just after the section starting
###############
#### RULES ####
###############
add the following line.
*.* ~
If you want to be more fine-grained you will need to read the file comments.
Do not forget to restart rsyslog daemon:
sudo service rsyslog restart
There already exists the Ramlog Debian package and installation instructions for this. However, this didn't work for me (Starting ramlog-tmpfs 2.0.0: Error: /var/log is in use... [fail]).
Using iotop -bktoqqq I figured out most frequent write access. It turns out that also /var/cache/samba/ is frequently written to. So this also has to go to RAM in addition to /var/tmp/ where the new log files will be.
So first these two entry have to be added to
/etc/fstab:
tmpfs /var/tmp tmpfs size=10M,nodev,nosuid 0 0
tmpfs /var/cache/samba tmpfs size=5M,nodev,nosuid 0 0
We need to save this script in /usr/local/bin/log2disk which will append and delete the contents from all log files in /var/tmp/log/ to the files in /var/log/.
#!/bin/sh
# Author: Frank Breitling <frank.breitling@gmx.de>
DESC="Moving contents from /var/tmp/log/ to /var/log/"
if [ $(id -u) -ne 0 ]
then echo "Please run as root"
exit
fi
echo $DESC
exec >>/var/log/log2disk.log 2>&1
date
cd /var/tmp/
for i in log/*; do
basename $i
cat $i >>/var/$i
>$i
done
and make it executable sudo chmod +x /usr/local/bin/log2disk.
We want to run this script every 3 hours and add this line to the system's /etc/crontab
10 */3 * * * root /usr/local/bin/log2disk
(Don't forget a final newline which is needed by crontab.)
We need to create a systemd service in /lib/systemd/system/log2disk.service that executes this script before shutdown and reboot, so that the log file contents gets preserved:
[Unit]
Description=Write log files to disk
RequiresMountsFor=/
Before=rsyslog.service
[Service]
Type=oneshot
RemainAfterExit=true
ExecStart=/bin/true
ExecStop=/usr/local/bin/log2disk
[Install]
WantedBy=multi-user.target
and install it with sudo systemctl enable log2disk.
Now we can tell /etc/rsyslog.conf which logfiles to keep in RAM. These files are auth.log, syslog, daemon.log, user.log and messages and we replace for each of their entries the log/ path by tmp/log/ for example like this:
auth,authpriv.* /var/tmp/log/auth.log
After a reboot, the system will now log the most frequent log entries to /var/tmp/log and sync them back every 3 hours and before shut down.
We can use iotop again to find a significantly reduced write activity.
However we should not be worried about the green ACT LED flashing. Apparently this is not a good write access indicator.
The way I circumvent this is by installing my root directory to a USB instead of the SD card. I use the SD card only for boot.
This kind of saves me having to worry about writes to my SD Card.
I use berryboot to achieve this.
Rather than editing rsyslog.conf you can simply stop the service if you want to eliminate all logs.
sudo service rsyslog stop
Then, you can disable it at boot:
sudo systemctl disable rsyslog
to enable it again at boot:
sudo systemctl enable rsyslog
Originally from: https://stackoverflow.com/a/32553762
To reduce logfile write operations on the RPi you could set up a centralized log server with rsyslog. If you want to keep the entries, just send the messages to the remote log server, else to /dev/null.
I would keep the logging and move it to USB drive. Good SanDisk 64GB or 128GB USB flash drive is nowadays cheap.
I have many Odroid XU4, Odroid C2, Raspberry Pi B+, and they all log to 64GB SanDisk USB 3.0 drives. It has plenty of space and I notice no performance issues!
I even run a web server on Odroid XU4 with 1TB Samsung USB SSD. OS is on eMMC.
Here's how you do it:
1. Stop rsyslog
sudo service rsyslog stop
2. Stop Apache
sudo service apache2 stop
3. Stop any other service that may be running and logging to /var/log/.
4. Unmount any mounted points to /var/log/ (you will remount later). For example on Armbian I have zram0 partition mounted to /var/log/ (/dev/zram0)
5. Backup any needed logs from /var/log/ Create desired log location and mount.
# Create the new log directory on the USB drive. In my case mounted as /logs/
mkdir -p /logs/var/log
cp -r /var/log/* /logs/var/log
Remove the log directory
rm -rf /var/log/
Create a symlink to the new location
ln -s /logs/var/log /var/log
Start the services
sudo service rsyslog start
sudo service apache2 start
Mount any unmounted /var/log/ partition(s), if unmounted!
sudo mount /dev/sdaX /your/location
Force logrotate retest after you move the log file.
This will clear "Excess permissions or bad ownership on file /var/log/btmp" error message.
sudo logrotate -v -f /etc/logrotate.conf
List the /logs/var/log/ directory ls -la /logs/var/log/
You may notice some logs or directories missing. When you restart all services you will see all previous services logging there.
Reboot!
This will restart all services and you will see all active logs in the /logs/var/log/ directory. If you decide not to move your existing /var/log/ logs, after the reboot all logs will be recreated at the new location.
I've been using SanDisk 64GB Ultra USB 3.0 Flash Drive ($10 an Amazon right now). Never in my 6 years use I had any of them fail.
