On Mon 27 Jul, 2026, at 14:40, Nicolas George wrote:
The Wanderer (HE12026-07-27):
> That was my own first thought as well, but it only works if you have
> that much control over the applications that will be writing the files
According to the original statement, that is syslog. If there are other
processes logging without going through rsyslog, it makes the issue that
much difficult.
> The only other fallback option that's occurred to me is to mount the
> root filesystem read-only
If the OP wants to avoid unwanted writes on the internal devices, I very
much hope that is the very first thing they did.
You can also mount a read-only ramdisk in between the root filesystem
(if it needs to be mounted read-write) and the usb. Assuming the
directory is /mnt/log. Something similar to those lines in /etc/fstab
may (untested) work.
tmpfs /mnt/log tmpfs defaults,ro 0 0
/dev/usb-block /mnt/log ext4 defaults 0 0
Loïc