The only way this is possible currently is to use the syslogng package. There you can set a location to use for log storage which can be a different drive or partition. If you then set /var as a ram drive system logging does not write to the drive.

BUT.... there is no built in management of different drives in pfSense so you need to use custom scripts to do that. Hence it's not supportable.

@stephenw10 I understand. Thanks for the info.

Then syslog. That was my second thought.

@JonathanLee said in UNOFFICIAL GUIDE: Have Package Logs Record to a secondary SSD drive Snort Syslog Squid and or Squid cache system:

ln -s -F /nvme/LOGS_Optane/snort /var/log/snort

Also you can do this with suricata.

/var/log/suricata remove this mkdir /nvme/LOGS_Optane/suricata ln -s -F /nvme/LOGS_Optane/suricata /var/log/suricata

@stephenw10 I reported it as (possible) spam (category 'other) yesterday.

It works great 👍👍 was able to do tests with 23.09 on a fresh firmware install with the new SSD drive and after backpedal back to my other SSD with 23.05.01 as needed for testing firmware. Great deal for use with SG2100.

IMG_20231214_162428521.jpg

@stephenw10 I have the cron job for it set to scrub once a month.