I wrote up some information on this for installing Slackware on the Eee 701 on
another forum, but the long and short of it is to just use syslog.
Lets say you mounted /tmp on tmpfs, and want syslog to write the really active files (I.E. messages and syslog) to it. You would modify your /etc/syslog.conf file as such:
Code:
# Log anything 'info' or higher, but lower than 'warn'.
# Exclude authpriv, cron, mail, and news. These are logged elsewhere.
*.info;*.!warn;\
authpriv.none;cron.none;mail.none;news.none -/tmp/messages
# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news. These are logged elsewhere.
*.warn;\
authpriv.none;cron.none;mail.none;news.none -/tmp/syslog
# Debugging information is logged here.
*.=debug -/tmp/debug
This will cause syslog to start writing them to the tmpfs mounted /tmp, rather than /var/log. You can also manually symlink anything you want to move over, like the XOrg log:
Code:
ln -s /tmp/Xorg.0.log /var/log/Xorg.0.log
You can actually link all of the logs back to their original locations, so that the fact that they are in /tmp is transparent to the end user; you would still access them through /var/log.
The advantage of using syslog directly is that you don't even need to mess with the rest of /var (like /var/packages); as the logs are really the most active files there anyway.