Re: Preventing writes to the underlying directory when a mounted filesystem disappears

[Dan Ritter <dsr@randomstring.org>]

Greg Wooledge wrote: 
> On Mon, Jul 27, 2026 at 08:25:40 -0300, Marcelo Laia wrote:
> > - Debian Testing
> > - rsyslog
> > - Log files stored on an external USB SSD
> > - The root filesystem should remain as untouched as possible, while   the
> > SSD receives all log writes.
> 
> > If the USB SSD is unexpectedly disconnected, the USB bus resets, or the
> > filesystem becomes unmounted for any reason, the mount point directory
> > still exists. As I understand it, applications may continue writing to
> > that directory, which now belongs to the underlying root filesystem. On
> > systems using flash storage, this could eventually wear out the internal
> > storage without immediately being noticed.
> 
> My first thought would be to create a subdirectory on the mounted external
> device, and write the logs to files within that subdirectory.
> 
> If/when the external device goes away, that subdirectory will not
> exist, so you won't be able to create the log files specified in the
> configuration.


This is the standard approach, and it works very well.

Example: mount your device at /mnt/logdevice, create
/mnt/logdevice/logs and use that as the top directory for the
logs.

-dsr-