On Mon 27 Jul, 2026, at 14:40, Nicolas George wrote:
> The Wanderer (HE12026-07-27):
> > That was my own first thought as well, but it only works if you have
> > that much control over the applications that will be writing the files
>
> According to the original statement, that is syslog. If there are other
> processes logging without going through rsyslog, it makes the issue that
> much difficult.
>
> > The only other fallback option that's occurred to me is to mount the
> > root filesystem read-only
>
> If the OP wants to avoid unwanted writes on the internal devices, I very
> much hope that is the very first thing they did.
You can also mount a read-only ramdisk in between the root filesystem
(if it needs to be mounted read-write) and the usb. Assuming the
directory is /mnt/log. Something similar to those lines in /etc/fstab
may (untested) work.
tmpfs /mnt/log tmpfs defaults,ro 0 0
/dev/usb-block /mnt/log ext4 defaults 0 0
Loïc
