começar por substituir o rsyslog pelo busybox-syslogd que funciona na ram:
apt install busybox-syslogd
apt purge rsyslog
adicionar ao sistema raiz noatime,commit=1800
tmpfs /tmp tmpfs defaults,noatime,nosuid,size=100m 0 0
tmpfs /var/tmp tmpfs defaults,noatime,nosuid,size=30m 0 0
tmpfs /var/log tmpfs defaults,noatime,nosuid,mode=0755,size=100m 0 0
tmpfs /var/run tmpfs defaults,noatime,nosuid,mode=0755,size=2m 0 0
tmpfs /var/spool/mqueue tmpfs defaults,noatime,nosuid,mode=0700,gid=12,size=30m 0 0
tmpfs /var/log/apt tmpfs defaults,noatime 0 0
tmpfs /var/cache/apt/archives tmpfs defaults,noexec,nosuid,nodev,mode=0755 0 0
http://www.zdnet.com/article/raspberry-pi-extending-the-life-of-the-sd-…
https://raspberrypi.stackexchange.com/questions/169/how-can-i-extend-th…
https://www.raspberrypi.org/forums/viewtopic.php?f=29&t=20505
https://wiki.linaro.org/WorkingGroups/KernelArchived/Projects/FlashCard…