syslog-ng uses a syslog-ng.persist file that is created in /var/lib. Per FHS 2.3 that should exist in a subdir, if not one specific to syslog-ng, then /var/lib/misc. http://www.pathname.com/fhs/pub/fhs-2.3.html#VARLIBVARIABLESTATEINFORMATION An application (or a group of inter-related applications) must use a subdirectory of /var/lib for its data. There is one required subdirectory, /var/lib/misc, which is intended for state files that don't need a subdirectory; the other subdirectories should only be present if the application in question is included in the distribution. [38] [38] An important difference between this version of this standard and previous ones is that applications are now required to use a subdirectory of /var/lib. This causes problems on diskless systems with a shared /var/lib. Subdirs that contain unique per system data are not shared, and instead mounted on top of the shared /var/lib. I could do the same thing even for a single file, syslog-ng.persist in this case. However given FHS, it should be written in a subdir. Which I can then make that unique per system, like other subdirs in /var/lib that are not shared amongst all diskless systems. Filed this with upstream https://bugzilla.balabit.com/show_bug.cgi?id=117 Their comments were to change this during configuration of the sources ./configure --localstatedir=/var/lib/misc Attaching a tiny patch
Created attachment 264625 [details, diff] localstatedir patch
fixed in syslog-ng-3.2.4
