Hi Tovis! I haven't figured out a way to do it using AuFS without moving /var, but AFAIK overlayfs does what you want. It's included in Ubuntu Oneiric kernel, but I'm not sure about Debian.
I'm looking for a way to do it without overlayfs requirement myself, if you find one, please let me know! Well, of course there are FUSE-based solutions, I've described one in a blog post: http://shnatsel.blogspot.com/2011/11/miniwheatfs-aka-reliable-ramdisks.html unionfs-fuse might work for you, I've managed to make it mount over non-empty dirs and it seems to work fine, but, as the name implies, it's very slow. However, in your case the USB drive can be even slower... try something like this: unionfs-fuse -o cow,max_files=32768 -o allow_other,nonempty,dev "/tmp/var"=RW:"/var"=RO "/var" -- Sergey "Shnatsel" Davidoff ------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-novd2d
