If you use the - option in syslogd configuration for non-synchronous writes then /var/log will be only a tiny portion of writes. If you have a mail server then

If you use the - option in syslogd configuration for non-synchronous writes then /var/log will be only a tiny portion of writes. If you have a mail server then the many log messages about a message delivery will have hardly any write load compared to all the synchronous writes to the mail queue and mail store. The only time I've seen a significant part of write load coming from /var/log is when the systemd-journald log database or a database server replication log or rollback log is there.