syslog filling /var/log despite being set to write to a share

[Can0n]

Hello I was getting a lot of /var/log getting full and is full alerts since unRAID 6.8 RC1

the culprit was that the syslog settings were set to mirror to flash as well as send to a share i set up. but since disabling the mirror to flash option and disabling syslog, removing the files from /var/log and re-enabling syslog its still writing to /var/log and not to my array as instructed. Am I missing something, maybe need to reboot to fully restart the syslog server??? that is one thing I have not tried yet

 

9:37am MTN

 

 

9:43am MTN

sif-diagnostics-20191027-1538.zip

[Squid]

Not that I've ever used it, but it appears to me by looking at the help is that enabling the syslog server and having it set to store logs on a share is for remote systems to connect to.  Not for it's own syslog.

[itimpi]

I do not think there is currently any way to stop the RAM copy of the syslog.    The syslog server simply allows a copy to also be stored elsewhere.   
 

Whether this might be a sensible future enhancement I have no idea as I am not sure what the implications might be.

[Can0n]

2 minutes ago, Squid said:

Not that I've ever used it, but it appears to me by looking at the help is that enabling the syslog server and having it set to store logs on a share is for remote systems to connect to.  Not for it's own syslog.

thanks @Squid i remember enabling for some troubleshooting a while back (ended up being a bad stick of ECC ram) I guess I could just disable it for now but perhaps the share is for log rotation only Ill monitor it for now and see if it ends up shifting the log to the array share