How to completely stop atop from creating logs for good?

Question

I've installed atop on a orangePi/RaspberryPi with only 40MB for /var/log.

It quickly filled my partition to 100%, I then purged it apt purge atop to remove it and its configuration files.

• atop binary doesn't exist
• its file in /etc/init.d doesn't exist
• no systemd service called atop

Nevertheless, after a reboot, the /var/log/atop folder comes back full with the old atop files.

• How can I completely remove it for good?

Edit:

$ ls /var/log/atop/
atop_20200822  atop_20200826  atop_20200830  atop_20200903  atop_20200907  atop_20200911  atop_20200915  atop_20200919
atop_20200823  atop_20200827  atop_20200831  atop_20200904  atop_20200908  atop_20200912  atop_20200916  atop_20200920
atop_20200824  atop_20200828  atop_20200901  atop_20200905  atop_20200909  atop_20200913  atop_20200917  atop_20200921
atop_20200825  atop_20200829  atop_20200902  atop_20200906  atop_20200910  atop_20200914  atop_20200918  atop_20200922

I removed atop on 2020/09/22, the last file. And it regenerates the same folder with the same files again and again after each reboot.

atop folders and files:

# find . -type d -name  *atop*
./usr/share/doc/libatopology2
./var/log.hdd/atop
./var/log/atop
./var/cache/atop.d

# find . -type f -name  *atop*
./usr/lib/arm-linux-gnueabihf/libatopology.so.2.0.0
./var/log.hdd/atop/atop_20200913
...
./var/log.hdd/atop/atop_20200906
./var/log/atop/atop_20200830
...
./var/log/atop/atop_20200826
./var/cache/atop.d/atop.acct
./var/lib/dpkg/info/libatopology2:armhf.symbols
./var/lib/dpkg/info/libatopology2:armhf.md5sums
./var/lib/dpkg/info/libatopology2:armhf.list
./var/lib/dpkg/info/libatopology2:armhf.triggers
./var/lib/dpkg/info/libatopology2:armhf.shlibs

Answer 1

atop runs as a systemd service located in /lib/systemd/system/atop.service, and its executable is: ExecStart=/usr/share/atop/atop.daily

This atop.daily wrapper file configures the logging of atop , as well as the specific frequency of the logrotation of corresponding log files.

To prevent atop.service from being ran as that service at boot you can do:

sudo systemctl disable atop.service

Option 2

If you really cannot find the binary for atop under normal means, you may check /etc/default/atop which is the old way it was configured.

As the last resort you can run:

sudo grep -ral atop /etc/*

And look in the corresponding files

Answer 2

On embedded systems such as OrangePi and RaspberryPi, Armbian uses log2ram to place the logs in the ram.

• /dev/zram0 49M 756K 45M 2% /var/log

With /var/log being just a logical copy (located in ram) of the /var/log.hdd.

Removing any folders/files from /var/log removes them only from the RAM and doesn't change the files/folders written in the disk/sd card.

That is the reason why the folder was coming back after each reboot.

Deleting the folder /var/log.hdd/atop solved the problem.

You can also disable the log2ram service: systemctl disable armbian-ramlog.service