On 2026-07-27 at 07:55, Greg Wooledge wrote: > On Mon, Jul 27, 2026 at 08:25:40 -0300, Marcelo Laia wrote: > >> - Debian Testing >> - rsyslog >> - Log files stored on an external USB SSD >> - The root filesystem should remain as untouched as possible, while >> the SSD receives all log writes. > >> If the USB SSD is unexpectedly disconnected, the USB bus resets, or >> the filesystem becomes unmounted for any reason, the mount point >> directory still exists. As I understand it, applications may >> continue writing to that directory, which now belongs to the >> underlying root filesystem. On systems using flash storage, this >> could eventually wear out the internal storage without immediately >> being noticed. > > My first thought would be to create a subdirectory on the mounted > external device, and write the logs to files within that > subdirectory. > > If/when the external device goes away, that subdirectory will not > exist, so you won't be able to create the log files specified in the > configuration.
That was my own first thought as well, but it only works if you have that much control over the applications that will be writing the files (and if they won't automatically create any "missing" directories in the path specified for them to write to). I haven't looked at rsyslog configuration specifically, this morning, so I don't know whether that consideration would apply in practice. The first alternative I've managed to think of would be to look at permissions, such that the processes that would be writing the files won't have write permission to the underlying directory, only to the mounted one. Depending on how the software involved will be configured, however, that could be difficult to adjust - and since this is apparently going to be a system-level service (rsyslog), it might kind of need some fairly high-end write access, such that this might be nontrivial to restrict. The only other fallback option that's occurred to me is to mount the root filesystem read-only, such that if the mounted writable FS goes away, any writes would be rejected for being to a read-only filesystem. Depending on what the situation surrounding this setup is intended to be, however, it could be the case that *other* things (external to the log daemon) will need to be able to write to the root filesystem - in which case that wouldn't be a viable option either. -- The Wanderer The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. -- George Bernard Shaw
signature.asc
Description: OpenPGP digital signature
