I have /var/log mounted as a tmpfs, where log files are synced periodically to the disk by the cron on FreeBSD. The process is done by the rc script.

I am mounting it like:

mount -t tmpfs -o nosuid,noexec,mode=0755,size=100M log /var/log

Now the problem is - unmounting it. It fails to unmount, because (r)syslog writes to the file. This is shown by lsof:

 lsof /var/log/
lsof: WARNING: compiled for FreeBSD release 11.1-RELEASE-p6; this is 11.1-RELEASE.
rsyslogd 85515 root    2w  VREG 255,2264924190      210   13 /var/log/security
rsyslogd 85515 root    4w  VREG 255,2264924190      210    3 /var/log/auth.log
rsyslogd 85515 root    5w  VREG 255,2264924190     2292    7 /var/log/kern.notice
rsyslogd 85515 root    6w  VREG 255,2264924190     2292   11 /var/log/messages
rsyslogd 85515 root    7w  VREG 255,2264924190     2292    5 /var/log/debug.log

So in order to unmount it, firstly I have to stop the syslog daemon. However, I am looking for some nicer solution, as this actions are managed by a sh rc script itself.

On the Linux/GNU Os's umount has a very handy argument: --lazy detach the filesystem now, clean up things later

, which by my knowledge, waits for an active processes to stop r/w to the filesystem, and then process with unmounting it, which would result in success and not breaking the script.

So as a workaround to this, how can I stop syslog temporary writing to /var/log ? I've tried issuing STOP, trying to umount and CONT signal, but no effect.

Lsof still reports that there are FD that are open to writing. Note that I need solution that can be applicable from sh script.



The umount has --force argument, which under normal circumstances I would avoid at any cost. But since this is a tmpfs and runs from a memory not block device, I believe it will do no harm.

Couple of tests showed that there are no issues. I did it by creating dummy files on tmpfs with dd, checked their sums, sync them to hdd, and then forcing the umount. The hashes matched which means that files weren't corrupted.

Well that is kinda dirty workaround, but I am not aware of other solutions. If someone has some drawbacks against this method on ram fs, please let me know.

ps: kudos to @layer8problem for advices :-)

  • 1
    Why do you use tmpfs instead of writing the logs directly to the disk? – uzsolt Jan 24 '18 at 19:41
  • 1
    Because I am running in on embedded, to save sdcard life. – fugitive Jan 24 '18 at 21:19
  • 2
    your embedded device will quickly run out of ram if you syslog to a tmpfs. have you considered remote syslog to another machine on the network? – cas Jan 25 '18 at 0:36
  • @cas Well, yes probably, but I have "plenty" of ram for this, as this being done on rpi2, also, logs are pretty much reduced to say. I am aware for the network loging, but not usable for me atm. Anyway, after talking with some people on #freebsd I've got a "solution". Will update my question. – fugitive Jan 25 '18 at 2:10
  • @fugitive: you wrote: "synced periodically to the disk" - I think you should redirect your logs to this disk. Or isn't possible? Or can you mount (maybe nullfs) your disk to /var/log? – uzsolt Jan 25 '18 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.