I’m learning so much about logging (though I may be wrong in some of this)! - Overlapped with your reply @pb66.
With the advent of systemd, most Linux implementations are doing dual logging. Log entries are going to either the journal (systemd-journal.service) or syslog (rsyslog) but anything going to the journal is by default sent to syslog as well.
The journal is recorded in a file structure under /run/log/journal. As you can see above (df -h output), the journal is on tempfs but is much larger than /var/log It is a binary file which also means, I think, it is more efficient in terms of space.
Daemons (systemd services) by default log to the daemon.log file. The default /etc/rsyslog.conf breaks out some log entries into a separate file as well as syslog. To prevent this @glyn.hudson added a daemon.none entry. Unfortunately, my EmonPi did not have that in the rsyslog.conf
*.*;auth,authpriv.none,daemon.none -/var/log/syslog
I’ve raised an issue Duplicate daemon.log logging · Issue #97 · openenergymonitor/emonpi · GitHub
I think I have been noticing it as I had set emonhub to DEBUG and emoncms to DEBUG as well but I suspect full logs is the reason for systems simply stopping.
What I now think is, that there is no need for log2ram. By either adjusting the rsyslog.conf file or setting the systemd-journal config to ForwardToSyslog=no we can eliminate virtually all the logging to /var/log.
There is an option to set the Journal to save the logs to disk (need to investigate if that can be time bound) and a log file can be generated on the fly journalctl -u emonhub.py > your.file.name from what is in the journal.
I think that was probably the issue 
.