At the end of Using a Raspberry Pi 2 Model B as a router/firewall for the home LAN I wrote that I decided not to put /var/log into tmpfs, because:

1. I wanted the logs to be persistent
2. I thought that the wear would result in less and less of the sd card to become available (and 16GB for logs should last a loong time)

As it turned out the sd card died after one month.

I don’t know if the cause was excessive logging, the use of ntopng (which did write quite a lot, both in the number of files, the number of files, and in the total storage used, which was approximately 0,5GB after 30 days of uptime) or simply a bad sd card.

However, going forward with a new sd card, I’ve done the following:

1. Removed ntopng
2. Put /var/log on tmpfs (limited to 100MB in size), synced to a backing store on the sd card using rsync

For setting up the logging I found some existing web pages that took me part of the way, but not all the way:

• Raspberry Pi: Extending the life of the SD card (this is where I got the fstab line from)
• Observium persistent ramdisk (this is where I got the script and the crontab settings from)
• Setting up overlayFS on Raspberry Pi (this is the where I got the systemctl command to set up the init.d script, as well as the script headers to make it work)
• How does systemd use /etc/init.d scripts? (more information about how systemd uses /init.d scripts)

Here is what I did:

1. Logged in as root and did everything below as root
2. Edited /etc/fstab and added the following line:

   tmpfs    /var/log    tmpfs    defaults,noatime,nosuid,mode=0755,size=100m    0 0

3. Created an /etc/init.d/ramdiskvarlog file with the following contents

   #!/bin/sh
   ### BEGIN INIT INFO
   # Provides:          ramdiskvarlog
   # Required-Start:    $local_fs $time
   # X-Stop-After:      $time
   # Required-Start:    $local_fs $time
   # Required-Stop:     $local_fs
   # Default-Start:     S
   # Default-Stop:      0 1 6
   # Short-Description: Restore to and save logs from tmpfs filesystem
   # Description:       Restore to and save logs from tmpfs filesystem
   ### END INIT INFO
   
   # /etc/init.d/ramdiskvarlog
   #
   
   case "$1" in
     start)
       echo "Copying files to ramdisk"
       rsync -av /var/backup/log/ /var/log/
       echo [`date +"%Y-%m-%d %H:%M"`] Ramdisk Synched from HD >> /var/log/ramdisk_sync.log
       ;;
     sync)
       echo "Synching files from ramdisk to Harddisk"
       echo [`date +"%Y-%m-%d %H:%M"`] Ramdisk Synched to HD >> /var/log/ramdisk_sync.log
       rsync -avy --delete --recursive --force /var/log/ /var/backup/log/
       ;;
     stop)
       echo "Synching logfiles from ramdisk to Harddisk"
       echo [`date +"%Y-%m-%d %H:%M"`] Ramdisk Synched to HD >> /var/log/ramdisk_sync.log
       rsync -av --delete --recursive --force /var/log/ /var/backup/log/
       ;;
     *)
       echo "Usage: /etc/init.d/ramdisk {start|stop|sync}"
       exit 1
       ;;
   esac
   
   exit 0
   

4. Made /etc/init.d/ramdiskvarlog executable:

   chmod +x /etc/init.d/ramdiskvarlog

5. Created a directory to store the logs persistently, and populated it initially with the contents of the existing /var/log with the following command line commands :

   mkdir -p /var/backup/log
   /etc/init.d/ramdiskvarlog sync

6. Made the /etc/init.d/ramdiskvarlog script be run at boot time and during orderly shutdown with the following command line command

   systemctl enable ramdiskvarlog

7. Made the /etc/init.d/ramdiskvarlog script copy the contents of /var/log to the sd card once every 24 hours
   1. At the command line gave the command

      crontab -e

   2. In the editor that opened on the crontab, added a line with the following contents

      2 7 * * * /etc/init.d/ramdiskvarlog sync >> /dev/null 2>&1

8. Created a test file with “touch /var/log/test.log”, rebooted the raspberry pi with “sync; reboot”, and then:
   1. Checked with the mount command that /var/log was on tmpfs, found the following line in the output, which meant that /var/log was on tmpfs

      tmpfs on /var/log type tmpfs (rw,nosuid,noatime,size=102400k,mode=755)

   2. Checked that the /var/log/test.log file was present (and the file was present, which meant that it had been synced to persistent storage on shutdown and restored on boot)

After completing the setup, I popped the sd card out and put it into a card reader on a debian desktop computer. Then I made an image of the working sd card, so that if/when the sd card dies, getting a working router again should be as quick as just dd’ing the image to a new sd card and then switching sd card on the raspberry Pi.

Lesson learned!