I'am running the latest Stretch server version on a PiOne (Linux 4.14.65-sunxi).
I think that something is going wrong with the logrotate. The rotation is done in /var/log.hdd directory (see also the scripts in /etc/logrotate.d/).
But the original file of each is in /var/log directory and is not "cleared" after the rename, because it is not renamed.
So, if Zram copies /var/log directory to the /var/log.hdd directory, the original file in /var/log with old logging and included new logging is written to the /var/log.hdd directory. In the next logrotate this growing file is compressed.
In this situation/in my case the compressed files contains all the loggings and not only the loggings of the last day or week or month, depending which file is compressed. And the file is still growing and growing.
Is my conclusion right or is something wrong in my Stretch installation. In the latest case, I could not find it. Please give me a hint.