AdGuard Home writes too much data onto flash partition

I have a Linksys MR8300. I have installed AdGuard Home and luci-app-statistics (collectd+rrdtool). I'm worried about the flash memory lifespan because of wear and tear.

AGH writes about 200 MB of querylog.json into the /tmp directory every week. I use a cronjob to move the file to my server once a week.

And this is what is worrying me:

Without my cronjob /tmp would be full after 10 days. Will this cause my router to age very quickly? If so, what could I do?

Here's some additional data that hopefully helps:

Filesystem                Size      Used Available Use% Mounted on
/dev/root                 4.5M      4.5M         0 100% /rom
tmpfs                   248.0M     59.8M    188.2M  24% /tmp <= this one fills up
/dev/ubi0_1              65.4M     20.1M     42.0M  32% /overlay
overlayfs:/overlay       65.4M     20.1M     42.0M  32% /
tmpfs                   512.0K         0    512.0K   0% /dev

mtdblock0    31:0    0    1M  1 disk
mtdblock1    31:1    0    1M  1 disk
mtdblock2    31:2    0    1M  1 disk
mtdblock3    31:3    0  512K  1 disk
mtdblock4    31:4    0  512K  1 disk
mtdblock5    31:5    0  512K  1 disk
mtdblock6    31:6    0    2M  1 disk
mtdblock7    31:7    0  512K  0 disk
mtdblock8    31:8    0  256K  0 disk
mtdblock9    31:9    0  256K  1 disk
mtdblock10   31:10   0   88M  0 disk
mtdblock11   31:11   0   85M  0 disk
mtdblock12   31:12   0   88M  0 disk
mtdblock13   31:13   0   85M  0 disk
mtdblock14   31:14   0    1M  1 disk
mtdblock15   31:15   0 70.5M  1 disk
ubiblock0_0 254:0    0  4.4M  0 disk /rom

The technical data states:

RAM: 512MB; Flash: 256MB

So I guess 256MB Flash is in /tmp?

If this is true and the flash is aging very quickly, then I should store /tmp/adguardhome/data/querylog.json somewhere else, like attaching a USB device onto the router. This would be done inside the AGH config at /etc/adguardhome.yaml.

I don't know why AGH is creating so much data, where Pi-Hole on my RPi didn't. A possible cause might be wpad, since 6,83 % of all queries are related to wpad domains, coming from 3 different clients (that's about 4500 wpad queries per day). But that's another issue.

Do you have any other ideas? Am I missing something? What would you consider best practice?

I'm pretty sure /tmp/ (tmpfs) is in ram per the standard images so anything written there has no usage of flash storage and disapears at every boot. You would have to reconfigure the system to have /tmp/ be on disk / flash storage.

You are correct, because Flash as well as RAM are mentioned as "Memory" in the technical specification. And I can confirm that /tmp is empty after a reboot.

BUT at the overview page /tmp is mentioned as storage. Is this misleading?

So, can I let this run for years or will the flash storage age quickly and become faulty and worn?

/tmp resides in RAM. RAM doesn't wear like other types of memory. You don't have to worry about excessive writes to /tmp.


I can see how you might think so but historically every place that data is at rest is considered storage, from CPU registers/cache and DRAM for program heap and stack space as primary storage, to hard drives, SSDs, flash drives, RAM Disks etc as secondary storage, and tertiary storage on media like magnetic tape, optical CD/DVD, and even paper tape and punch cards.
see for a more full explanation.

General use computers usually make use of virtual memory, using slow but inexpensive magnetic disk/SSD/flash disk (secondary storage) emulating primary storage to have more programs with large data sets running concurrently.

Systems like our OpenWrt router/firewall units have more DRAM than is needed for primary storage but lack robust secondary storage that support large write cycle counts so the secondary storage is emulated in DRAM, though it is volatile and unable to persist beyond a power cycle.

d687r02j8g answered your second question well.

1 Like

I just set

  querylog_file_enabled: false

in AdGuardHome.yaml

1 Like

That's great, and I'd mark my question as solved, if /tmp was 512MB, not 256MB.

I understand /tmp is typically in RAM memory. This could be a device-dependend situation.

Please check the device page at It says:

Hardware Highlights:
Flash MB: 256NAND
RAM MB: 512

Are you still sure my 256 MB big /tmp directory is in RAM, not NAND Flash? And is it true that NAND flash wears out quickly?

Thanks, but I like the query log for statistical reasons. Though I'm wondering what Pi-Hole did better.

Unless explicitly specified (it isn't), the default size for any tmpfs mount is (up to) 50% of the (visible) RAM.

And yes, /tmp/ is tmpfs backed on OpenWrt.


Yeah, that would explain it! Thanks a lot @slh! Also thanks to all of you for replying :slight_smile:

Also, I found another comment that supports your statement. And also with a dual firmware Linksys device:

To wrap this up: What is the 256MB NAND Flash typically used for? Is this the "real" RAM like I have 32GB in Windows?

NAND is not RAM.
NAND or NOR Flash storage on devices like home routers, switches and APs is used to hold the software to boot and run the system along with the added packages and configuration files etc. On devices with wifi, the radio calibration settings are stored on flash and there can be a few other things on there.

A simplified answer is that flash storage is used like the hard drive on a PC or flash on a smart phone. The difference is that SOHO router type devices tend to minimize frequent writes to flash so they use /tmp/ on RAM for volatile storage.

In your first post, you show output with a list of partitions on the flash.
mtdblock0 - mtdblock15.

See for some more OpenWrt specific info.

1 Like

All your questions can be answered if you reboot the router.
Are your old queries still there after a reboot?
If yes, then we're all wrong and you're right.
If the queries are gone, I have a question: What is the "statistical reason" to keep the queries in RAM and also in a file that also resides in RAM if they are gone anyway after a reboot?
LE: replaced stats with queries since we were talking about the querylog.json.

I've overlooked this graph for Memory usage:

The drops in used ram are at the same time as they are at /tmp.

The RAM is almost double the size of the Flash. It's strange as I don't understand where these 480.7MB come from.

I'm posting this just for the sake of completeness.

That was a very good read. Now I understand mtdblocks much better. But I'm not an OpenWrt developer anyway :grin:

Those 480.7MB are the portion of the 512MB of the DRAM chip on the system board reported as available to the operating system and applications. The other 31.3MB is reserved and/or otherwise not available to the operating system and applications.

The default setting in OpenWrt for the /tmp/ file system is to use about 1/2 of the available RAM so there is RAM available for dynamic allocation to other system components and applications that run.

1 Like

Thanks for the explanation! :+1:

Yes, the fact about 50% of the available RAM is clear to me.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.