I have a service created to run rtl_433 on a pi with an sdr dongle attached for sensor capture (door/window sensors, weather station, room temp sensors, etc):

pi@pi4b8:/etc/systemd/system $ cat rtl_433.service 
# based on https://github.com/merbanan/rtl_433/issues/1651
[Unit]
Description=RTL_433 service script
StartLimitIntervalSec=5
Documentation=https://github.com/merbanan/rtl_433/README.md
After=syslog.target network.target

[Service]
Type=exec
ExecStart=/usr/bin/rtl_433 -C si -F mqtt

# Restart script if stopped
Restart=always
# Wait 30s before restart
RestartSec=30s

# Tag things in the log
# View with: sudo journalctl -f -u rtl_433 -o cat
SyslogIdentifier=rtl_433

StandardOutput=syslog
StandardError=syslog

[Install]
WantedBy=multi-user.target

There’s something that sets rtl_433 to freak out and just hammer the /var/log/syslog and daemon.log files until the drive is 100% full thanks to repeating lines of this:

pi@pi4b8:/var/log $ tail syslog -n 1000
Nov 24 21:50:30 pi4b8 rtl_433[549]: LIBUSB_ERROR_INVALID_PARAM: Invalid parameter!
Nov 24 21:50:30 pi4b8 rtl_433[549]: Check your RTL-SDR dongle, USB cables, and power supply.
Nov 24 21:50:30 pi4b8 rtl_433[549]: LIBUSB_ERROR_INVALID_PARAM: Invalid parameter!
Nov 24 21:50:30 pi4b8 rtl_433[549]: Check your RTL-SDR dongle, USB cables, and power supply.
Nov 24 21:50:30 pi4b8 rtl_433[549]: LIBUSB_ERROR_INVALID_PARAM: Invalid parameter!
Nov 24 21:50:30 pi4b8 rtl_433[549]: Check your RTL-SDR dongle, USB cables, and power supply.
Nov 24 21:50:30 pi4b8 rtl_433[549]: LIBUSB_ERROR_INVALID_PARAM: Invalid parameter!
Nov 24 21:50:30 pi4b8 rtl_433[549]: Check your RTL-SDR dongle, USB cables, and power supply.
Nov 24 21:50:30 pi4b8 rtl_433[549]: LIBUSB_ERROR_INVALID_PARAM: Invalid parameter!
Nov 24 21:50:30 pi4b8 rtl_433[549]: Check your RTL-SDR dongle, USB cables, and power supply.

I need to get some sort of error checking that will either restart the service, or kill it when one of those lines hit the syslog. Is that something I can roll into the service, or do I need to do some sort of cronjob or second service that checks every couple seconds and restart/stops the service?

Normally, it works fine (months between restarts and never an issue). This server also hosts my primary pihole dns. When rtl_433.service ends up filling the disk, it ultimately results in /var/lib/unbound/root.key being blank, prohibiting unbound from starting after I clear the bloated logs and reboot. I have a secondary pihole/unbound to copy the key back from, but without some alert, I don’t discover this condition until dns stops working.