Move syslog to USB drive script, where stop returns firmware state. Tested with RT-N56U router + Padavan firmware.

S05syslogd

#!/bin/sh
# save as /opt/etc/init.d/S05syslogd
# chmod +x,go-w /opt/etc/init.d/S05syslogd
# /opt/etc/init.d/S05syslogd start

MOUNT=/media/Main
FOLDER=/Syslog

# better not change anything below here
SOURCE=/tmp/syslog.log                 # original source of the syslog on /tmp
NAME=syslogd
DESC="syslogd"
SYSLOG=${MOUNT}${FOLDER}/syslog.log    # destination of the syslog on USB disk

case "$1" in
start0)
printf "Starting ${DESC}: "
logger -t "($(basename $0))" $$ Syslog move to $MOUNT running...... `date` [$@] 
if [ ! -d ${MOUNT} ]; then
	logger -t "($(basename $0))" $$ ${MOUNT} labelled and mounted USB drive is missing. Premature exit. `date` [$@]
	exit $?
fi
if [ ! -d ${MOUNT}${FOLDER} ]; then
	mkdir ${MOUNT}${FOLDER}
fi
if [ ! -w ${MOUNT}${FOLDER} ]; then
	logger -t "($(basename $0))" $$ ${MOUNT}${FOLDER} is not writable. Premature exit. `date` [$@]
	exit $?
fi

# Stop existing syslogd
if [ -n "`pidof syslogd`" ]; then
	# store current running cmd to /tmp
	ps | grep -m1 "[/]sbin/syslogd -s" | awk '{$1=$2=$3=$4=""; print $0}' |  sed -e 's/^[ \t]*//' > /tmp/cmd_syslogd
	chmod go-w /tmp/cmd_syslogd
	killall syslogd
fi

# Add lines from tmp syslog to USB syslog and create symlink
if [ ! -L $SOURCE ]; then
	if [ -f $SOURCE ]; then 
		cat $SOURCE >> $SYSLOG
		# delete tmp syslog file
		unlink $SOURCE
	fi
	# create symbolic link to allow router GUI to see syslog
	ln -s $SYSLOG $SOURCE
fi

# Restart SYSLOG on the USB disk with 20Mib (having issues? limit to 4096 = 4Mib) size
/sbin/syslogd -O $SYSLOG -b 99 -S -D -s 20000
printf "${NAME}.\n"
logger -t "($(basename $0))" $$ Syslog move to $MOUNT complete...... `date` for $SYSLOG 

if [ "$?" -ne 0 ]; then    # check for error
   echo "Error in Syslog move! Script: $0"    # display the error message
   exit $?
else
   echo "Syslog move OK."    # display OK message
   exit 0
fi
;;
stop)
logger -t "($(basename $0))" $$ Syslog move to $SOURCE running...... `date` [$@] 
if [ -n "`pidof syslogd`" ]; then
	printf "Stopping ${DESC}: "
	killall "${NAME}"
	printf "${NAME}.\n"
fi
if [ -L $SOURCE ]; then
	# remove symbolic link
	unlink $SOURCE
fi
# start firmware syslogd
echo "Start firmware syslogd"
# should start from /sbin/rc service, no clue how to do that, workaround with tmp store initial started params.
if [ -s /tmp/cmd_syslogd ]; then
	# check that file contents starts with /sbin/syslogd
	exec 3<&0
	exec 0</tmp/cmd_syslogd
	read line
	exec 0<&3
	case ${line} in
		'/sbin/syslogd -s'*) # Busybox ash doesn't do [[ … ]] comparisons
			# execute the stored command
			source /tmp/cmd_syslogd
		;;
		*)
			logger -t "($(basename $0))" $$ /tmp/cmd_syslogd contains invalid data [$@]
		;;
	esac
else
	# fallback command for 128MiB router
	/sbin/syslogd -s512 -b0 -S -D -O /tmp/syslog.log
fi
logger -t "($(basename $0))" $$ Syslog move to $SOURCE complete...... `date` for $SYSLOG 
;;
start)
$0 start0
;;
restart|force-reload)
$0 stop
sleep 1
$0 start0
;;
*)
printf "Usage: $0 {start|stop|restart|force-reload}\n" >&2
exit 1
;;
esac