This is what I do for an IR camera project.
Set up everything how I like it, set root read-only and mount tmpfs in various areas such as /var/log etc..
Set up everything how I like it, set root read-only and mount tmpfs in various areas such as /var/log etc..
It does this whether or not a syslog daemon is running. (All messages it captures goes through the journal and then are forwarded along)
You'll still be able to look @ recent logs with journalctl commands.