As stated in my comment, a writable
/var/log is kind of important but there are things you can do to ensure that as little gets saved as possible. For example, you can configure
logrotate to rotate the log files based on their size, compressing the old ones. You can also configure
syslog to only write
CRIT and above to the logs (the rest are discarded)
/usr/bin/killall -HUP syslogd
(You would need to configure
logrotate /etc/logrotate.conf to be ran in a cronjob as well).
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
This is probably the best middle ground as next to nothing gets logged but you're still notified of critical events. You may also think about configuring remote syslog to a server with bigger storage if log retention is important.