Explanations: The script creates a `/var/log` mount point in RAM. So any writing of the log to the `/var/log` folder will not actually be written to disk (in this case to the SD card on a Raspberry Pi) but directly to RAM. By default, every day the CRON will synchronize the contents in RAM with the folder located on the physical disk. The script will also make this copy of RAM to disk in case of machine shutdowns (but, of course, it still won't do it in case of power failures). This way you can avoid excessive writing on the SD card and extend its life.
[Log2Ram](https://github.com/azlux/log2ram)'s script works on every Linux system. If you don't have Systemd, you can still use Log2Ram with your own daemon manager.
Log2Ram is based on transient /var/log for Systemd. For more information, check [here](https://www.debian-administration.org/article/661/A_transient_/var/log).
You need to stop Log2Ram (`systemctl stop log2ram`) and execute the [installation](#installation) process. If you used APT, this will be done automatically.
-`USE_RSYNC`: (commented out by default = `true`) use `cp` instead of `rsync` (if set to `false`).
-`MAIL`: disables the error system mail if there is not enough place on RAM (if set to `false`).
-`PATH_DISK`: activate log2ram for other path than default one. Paths should be separated with a `;`.
-`ZL2R`: enable zram compatibility (`false` by default). Check the comment on the config file. See https://github.com/StuartIanNaylor/zram-swap-config to configure a zram space on your raspberry before enable this option.
... Or even disable it altogether with `systemctl disable log2ram-daily.timer`, if you instead prefer Log2Ram to be writing logs only on system stops/reboots.
One thing that stops Log2Ram from functioning is if `/var/log` is too large before starting Log2Ram the first time. This can happen if logs had been collected for a long time before installing Log2Ram itself. Find the largest directories in `/var/log` (this example command only shows the 3 largest):
If the `/var/log/journal` is very large, then there are a lot of system logs. Deletion of old "archived" logs can be fixed by adjusting a setting. Edit the `/etc/systemd/journald.conf` file and add the following option: