Sometimes, you need to rotate your logs hourly instead of daily or weekly, if you have a big virtual environment many things needs to be logged. Sometimes daily logs are so huge that you need hourly log-rotation. For this one you need to customize some of the settings in your central syslog server. You can find the sample steps below to create logrotate configuration that rotates the logs hourly.

Steps:

1 - Copy /etc/cron.daily/logrotate to /etc/cron.hourly and set it as executable.

1
2

# cp /etc/cron.daily/logrotate /etc/cron.hourly
# chmod u+x /etc/cron.hourly/logrotate

2- Create a folder logrotate.hourly.conf in /etc

# mkdir -p /etc/logrotate.hourly.conf

3- Modify the file logrotate in the /etc/cron.hourly based on your needs. See below for sample.

1
2
3
4
5
6
7
8

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.hourly.conf/example
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit $EXITVALUE

3- Create your logrotate script in the folder /etc/logrotate.hourly.conf

For this post, we named it as ‘example’. (We also specified it in the configuration /etc/logrotate.hourly.conf/logrotate)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

/opt/logs/[2-9][0-9][0-9][0-9]/[0-9][0-9]/[0-9][0-9]/*.log {
    notifempty
    compress
    maxage 60
    rotate 200
    create 0600 root root
    size 4G
    postrotate
        /usr/bin/systemctl reload syslog-ng > /dev/null
    endscript
}

• You may need to tune up rotate, size and maxage options based on your needs.