I'm running OPNsense 20.1.7-amd64 with a zpool as the boot file system. I was messing around with my opnsense system, trying to tweak a few things to improve security. Out of boredom I looked to see how much stuff is being written to the logs and such. I used "zpool iostat 1" to see what was going on. I was a bit surprised.
Every 5 seconds anywhere from 600KB to 6MB is written to the boot device. 5 seconds being the flush time for async writes with zpools, means that basically stuff is being written constantly. Not a big deal as my boot device is a 32GB SLC drive, so wearing it out isn't too likely (its still indicating 99% drive life left after 10 years in various servers). However, I went looking to see what is writing all this data.
First I did some detective sleuthing on my own and disabled netflow, rrd graphs, and firewall logging. It didn't seem to help much. I also tried setting /var and /tmp to be memory devices and rebooted and the writes continue.
So now I'm trying to figure out what files specifically are being written to the boot device regularly so I can identify what is going on and if I have a setting somewhere that is set to some kind of really high level of logging that is unnecessary.
Anyone know how I can do this?