Determine cause of constant writes to the boot device

[j_s]

I'm running OPNsense 20.1.7-amd64 with a zpool as the boot file system.  I was messing around with my opnsense system, trying to tweak a few things to improve security.  Out of boredom I looked to see how much stuff is being written to the logs and such.  I used "zpool iostat 1" to see what was going on.  I was a bit surprised.

Every 5 seconds anywhere from 600KB to 6MB is written to the boot device.  5 seconds being the flush time for async writes with zpools, means that basically stuff is being written constantly.  Not a big deal as my boot device is a 32GB SLC drive, so wearing it out isn't too likely (its still indicating 99% drive life left after 10 years in various servers).  However, I went looking to see what is writing all this data.

First I did some detective sleuthing on my own and disabled netflow, rrd graphs, and firewall logging.  It didn't seem to help much.  I also tried setting /var and /tmp to be memory devices and rebooted and the writes continue.

So now I'm trying to figure out what files specifically are being written to the boot device regularly so I can identify what is going on and if I have a setting somewhere that is set to some kind of really high level of logging that is unnecessary.

Anyone know how I can do this?