/var/log stays as tmpfs even when [Full] is activated

General Discussion
1

Hello all, first post here.

I’ve setup a Rock64 with a 64 GB SD and external 1.5 TB USB drive on the last DietPi (as of today).
Everything works right but the /var/log.

I chosed [Full] on the initial setup but found out that:

  • it’s 50 MB only
  • it’s a tmpfs (tmpfs on /var/log type tmpfs (rw,nosuid,nodev,noatime,lazytime,size=51200k)
  • it’s not defined /etc/fstab

So using dietpi-software I switched to [DietPi-RAMlog #1] then back to [Full].
Same issue.

How could I fix this?
Actually I’d like to use a directory on the USB drive to store /var/log but can’t find the proper way to do it.

2

The problem is, that there is nothing in /var/log or that it’s not on your external drive?

Did you reboot after changing the logging options?
You can just symlink a folder from your external, so /var/log points to this folder, like

sudo ln -s /mnt/external/var-log /var/log

But before that, make a backup of your logs, if you need. Then stop the services:

sudo systemctl stop rsyslog
sudo systemctl stop systemd-journald

Then remove /var/log and create the symlink.
You also need to adjust the permission of the folder you link to, youcan see the current permissions with ls -la /var/log.

3

From my point of view, there are several problems.
The main is that it’s a tmpfs (while it should be on the disk) of 50 MB (and it eventually got full).
Also, there’s nothing in /etc/fstab about /var/log meaning he tmpfs is created by something else, not /etc/fstab (what/where?).

I tried the symlink method, it works (rsyslog writes to the mounted disk).

But as I though the tmpfs is created on boot bydietpi-software I didn’t know what would happen on boot (the Rock64 is headless and 500 miles away from me).
So I used dietpi-software again to do the same changes than in my initial post (from Full to #1 back to Full).
I ended up with the same “issue”: a tmpfs of 50MB.
tmpfs on /opt/log type tmpfs (rw,nosuid,nodev,noatime,lazytime,size=51200k)

Right now, I unmounted the tmpfs (again) and I’m using the symlink.
But I don’t know what will happen on next boot.

4

/var/log is part of /, so it’s mounted on the disk where / is mounted. And for / you have an entry in fstab.
If you choose logging option 1 or 2 it creates a tmpfs on RAM which points to /var/log, so it’s not anymore on disk, but pointing now to the tmpfs in memory.
So for option 1 and 2 there is an entry in fstab, made by the script: https://github.com/MichaIng/DietPi/blob/5f69eebea01ce277d48333ffa21b844d5a068c3b/dietpi/dietpi-software#L2903C4-L2903C101

echo "tmpfs /var/log tmpfs size=${var_log_size:-50}M,noatime,lazytime,nodev,nosuid" >> /etc/fstab

When you then switch to full logging, this entry gets removed and /var/log is again mounted on the disk

As you can see, this tmpfs points to /opt/log and not /var/log, your /var/log is part of /

5

I’m sorry but that’s not what is on my Rock64 right now.
That’s why I opened this thread

Even with option 3, there’s a tmpfs created, exactly as the script you linked is suppose to do with option 1 and 2 (and not 3).

I setup the Rock64 using “Full” and got this behaviour (I found out because /var/log got “no space left” while I chosed “Full” to avoid the 50 MB tmpfs in RAM limitation).

I went back to dietpi-software, chosed option 1, saved, exited, back to dietpi-software, chosed option 3 (Full) saved, exited and it’s again the tmpfs of 50 MB…

So as this did not work I posted here and tried your suggestion so, I manually:

  • stop the services (rsyslog & systemd-journald)
  • copied the logs files to /opt/log
  • unmount /var/log (lazy unmount or it won’t unmont)
  • created the symlink between /var/log to /opt/log
  • restarted the services and verified logging was OK
  • went to dietpi-software
  • chosed option 1 and saved and exited
  • went back to `dietpi-software’
  • chosed option 3 and save and exited
  • the symlink I created was replaced by this tmpfs on /opt/log type tmpfs (rw,nosuid,nodev,noatime,lazytime,size=51200k
6

Interesting, on my test system its 100mb.
tmpfs tmpfs 100M 16K 100M 1% /var/log

I set then Full logging in dietpi-software and chose Install (maybe you skipped that part?)
After a reboot (maybe you skipped that too?) the tmpfs for /var/log is gone.

7

And now I did the reverse, changed from option 3 to 1, install, in this case no reboot is needed.
Voilá

tmpfs          tmpfs        100M   44K  100M   1% /var/log
8

I went through “install” but I did not reboot (as I’m not sure what will happen on reboot).

However I definitively do not get it.
You went from option 1 to option 3 (3 is Full), so you’re suppose to have “nothing” defined/mounted for /var/log as it should be just a local (sub)folder on /.
Still, you’re getting a tmpfs of 100M.

So it’s not working for you either (the difference between you and me being the size, you have 100M where I have 50M).

Or it _needs_a reboot to get things to work correctly?

9

Sry for the confusion, I mixed things up. I switched from 1 to 3, rebooted, tmpfs is gone.
Then back from 3 to 1 without reboot, tmpfs is present.

Summary

Initially I had option 1, so there is a tmpfs for /var/log but for some reason it’s 100m (maybe I changed it to 100mb in the past, idk).
Then I switched to option 3 and this needs a reboot to remove the tmpfs. Because after instalaltion I checked, it was still there, but after the reboot the tmpfs for /var/log was gone.

Then I switched back to option 1, this is working without a reboot.

Only if you switch from RAM to FULL , but not the other way around.

10

I’ll reboot it when I’m next to it and report how it goes.

Thank you.

1 Like
11

I made another test:
I switched again from RAM to full logging, but then I unmounted the tmpfs manually instead of a reboot. It also makes sense that you can not unmount it without a reboot, because stuff is constantly writing to it, so I did a lazy umount.
But now the log folder is just empty, so I guess the reboot is necessary to fully apply the change.

After a reboot all my logs are again available under /var/log

@MichaIng maybe we should note this in the docs or make a reboot prompt when switching from RAM logging to full log?

12

True, a reboot prompt makes sense. But I also want to implement an uninstall without required reboot. As services are stopped, an unmount should work in most cases, else we can do lazy unmount and give it 2 seconds or so, then check back status. If it is still mounted, we can still prompt for a reboot.

1 Like