First, if you want to analyze what's in root, it's best to remount it. There are several mount points in it, and often files are "underneath" the mounts, and therefore hidden.
# mount --bind / /mnt
You can later on unmount it with
# cd /
# umount /mnt
Also, in most systems /data is also a mount point (for the data volume). So check /mnt/data after you remount it, and make sure rsyslog is where you think it is.
root@NETGEAR-NAS:/var/lib/mysql# ls -lrtah ibdata1 -rw-rw---- 1 mysql mysql 990M Dec 21 08:47 ibdata1
/data is all in /data/rsyslog - I did delete these - but they steadliy re-appear.
A stock OS-6 ReadyNAS doesn't use rsyslog or mysql at all. You must have installed an app (or package) at some point that does. Given the file date on mysql, and the fact that rsyslog keeps coming back, that added software must still be running. There used to be a third-party app called LogAnalyzer - if you installed that, you should uninstall it.
There are two options here:
Track down the packages/apps that were installed, and uninstall them. Then delete /data/rsyslog and /var/lib/mysql. (A variation on this is to do a factory default, rebuild the NAS, and restore the data from backup).
Move the two folders into a share on the data volume. Then create soft links in /data and /var/lib that point into those folders. The files will continue to grow, but of course the data volume is much larger than the OS partition.
I will just truncate that table - as will fix issue for a few years.
But would be good to know what is pushing data into it?
The most likely cause is the old LogAnalyzer app - likely not uninstalled correctly. You could try to track that down by looking in apt-history in the log zip file.
As I mentioned, using soft links will let you move the folders onto the data volume. That will protect the OS volume from filling (which can corrupt your configuration files).
