still see entries in syslog file about log2ram HOT 8 CLOSED

The Reloading Log2Ram isn't really necessary as its debatable on a complete crash if anything up to an hour is lost then what use is the hour preceeding.
You can use the service reload function at anytime to sync to persistent bind directory.

So remove the cron job as that is all its doing and really Reloading Log2Ram means it is working.

[Service]
Type=oneshot
ExecStart= /usr/local/bin/log2ram start
ExecStop= /usr/local/bin/log2ram stop
ExecReload= /usr/local/bin/log2ram write

log2ram.hourly

#!/usr/bin/env sh

systemctl reload log2ram

from log2ram.

thank you for your kind reply and support! I?m not a linux expert so I'm trying to figure out correctly what you wrote..
the main question was about the fule syslog which keeps writing on the SD, and I expected to be sync only after reload, why?
Maybe log2ram is logging on RAM some logs but not all the log folder?
About reloading I'm fine with that, as well as lose the last hour of activity. Thank you

from log2ram.

Apols basically what log2ram does because you can not mount zram ontop of an existing directory.

Firstly it creates a bind mount so that /var/log can be moved elsewhere then you can create a /var/log in zram, but its empty.
So it copies all from the original /var/log now at a bind mount on start.
zram is completely volatile and non persistent and log2ram writes via a cron job every hour to update any changes and also on stop.

I sort of agree the hourly write is sort of pointless in terms of SD write so in /etc/cron.hourly delete the log2ram entry and no more hourly writes but sync will still happen on start or stop.

There are a few things with the service and method of log2ram that IMHO are mweh.
Have a look at https://github.com/StuartIanNaylor/zram-config as it sound like it might suit your needs better,

from log2ram.

sorry maybe I expressed myself wrongly, I'm fine with hourly writes on sd, I don't want to chenage them.
The problem is that the file var/log/syslog is keep written when an event is coming, I don't need to wait one hour to see the entry, I open anytime the file and see the new entries like before.
If you said that the entirely log folder is created on ram and updated only there, I don't know how this is possible.
I hope you understood my point, thanks for help!

from log2ram.

Hi
It's because with log2ram, the folder /var/log is a RAM folder (tmpfs to be exact).

The syslog system don't care I have change the type of this folder and continue to write all log as a simple directory.

Hope it help.
Az

from log2ram.

so if I understood right the path /var/log is now on RAM, and how and where can I see the real var/log on the sd?
thank you

from log2ram.

The data on Disk is on /var/hdd.log/

from log2ram.

very interesting, perfect! thanks

from log2ram.