Preventing NVMe Wear: Reducing Small Write "Pulsing" in IPFire

Hardware
1

I’ve been monitoring the wear and tear on my IPFire hardware (“Topton-style” Fanless Mini PC) and wanted to share some telemetry regarding NVMe endurance. While most focus on Total Bytes Written (TBW), I found that Host Write Commands are often the silent killer for budget-friendly SSDs.

My System Stats (CWdisk-128G):

  • Power On Hours: 14,866 (~1.7 years)
  • Total Data Written: 4.81 TB
  • Host Write Commands: 855,947,755
  • Current Wear: 1% used

The Issue:
The high command count indicates an average write size of only ~5.6 KB per command. This frequent “pulsing” triggers high Write Amplification, as the controller must cycle NAND pages even for tiny metadata updates.
On CU200, I noticed that Suricata’s default stats interval (8s) was a major contributor to these frequent small writes on the NVMe disk.
I estimate that in just 26 hours, these suricata stats alone generated over 23,000 write operations.

To mitigate this, I’ve disabled Suricata’s internal statistics. (little to no value for me these stats)

Suricata Configuration Change:
In /etc/suricata/suricata.yaml:

# Global stats configuration
stats: 
    enabled: no
    interval: 0

Discussion:
Beyond disabling unnecessary Suricata stats logs, what other optimizations are you using to increase the lifespan of NVMe disks in IPFire?
Have you identified other processes that write small amounts of data very frequently (seconds apart) and tuned them?

2

I’m just thinking out loud:

Your SSD has lost exactly 1% of its lifespan in 1.7 years

So it’ll last ~170 years before it’s ‘worn out’ ^^

You’re worrying too much, in my opinion

3

Yes, I agree. In all those years of building our own appliances, we never had a single one break because of too many writes to the SSD.

You should also consider what would happen if we actually went to the other side of the spectrum and didn’t write content immediately. We want to keep a complete paper trail of logs and any other events so if there is any kind of incident when someone breaks the firewall, you will have a chance to investigate. That could even be something very simple like a loss of power.

SSDs don’t break any more. You should not worry.

IPFire is already writing very minimal, but what gets written is important and needs to be stored reliably.

4

One option that I am looking into is doing syslog to my backup server like have all my other devices doing