Configuring Hourly Log Rotation with Logrotate and Rsyslog

System administration
Comments

Logrotate runs daily by default on Debian Linux. It is scheduled to run at 00:00:00 with systemd:

markku@logtest:~$ systemctl list-timers
NEXT                        LEFT          LAST                        PASSED        UNIT                 ACTIVATES
Mon 2023-11-20 00:00:00 EET 2h 20min left Sun 2023-11-19 00:00:17 EET 21h ago       logrotate.timer      logrotate.service
...

When you want logrotate to rotate files hourly, you need two changes:

  1. You need to edit the relevant logrotate configuration files to use hourly instead of daily
  2. You need to edit the systemd timer configuration for logrotate to be run hourly instead of daily.

For demonstration I created new configuration in /etc/logrotate.d/local:

/var/log/local
{
        rotate -1
        maxage 1
        hourly
        dateext
        dateformat -%Y%m%d-%H
        datehourago
        missingok
        compress
        sharedscripts
        postrotate
                /usr/lib/rsyslog/rsyslog-rotate
        endscript
}

Specific explanations:

  • rotate -1: don’t have a limit based on number of rotated files
  • maxage 1: delete rotated files older than one day
  • datehourago: in the rotated file name, use the previous hour (= the hour when the logs were collected) instead of the current hour (= when the rotation happened)

To actually use the new log file I configured in /etc/rsyslog.d/local.conf:

local0.*        /var/log/local

and restarted rsyslog with sudo systemctl restart rsyslog.

Finally I reconfigured the timer with sudo systemctl edit logrotate.timer and entered these in the configuration:

[Timer]
OnCalendar=hourly
AccuracySec=1us

To actually log something in the new log file I added a cron job to run this command every 5 minutes:

logger -p local0.info -i "Testing"

This is how the log files look like after running this setup for a couple of days:

markku@logtest:/var/log$ ls -l local*
-rw-r----- 1 root adm 126 Nov 21 22:05 local
-rw-r----- 1 root adm 190 Nov 20 22:55 local-20231120-22.gz
-rw-r----- 1 root adm 191 Nov 20 23:55 local-20231120-23.gz
-rw-r----- 1 root adm 195 Nov 21 00:55 local-20231121-00.gz
-rw-r----- 1 root adm 192 Nov 21 01:55 local-20231121-01.gz
-rw-r----- 1 root adm 190 Nov 21 02:55 local-20231121-02.gz
-rw-r----- 1 root adm 191 Nov 21 03:55 local-20231121-03.gz
-rw-r----- 1 root adm 192 Nov 21 04:55 local-20231121-04.gz
-rw-r----- 1 root adm 193 Nov 21 05:55 local-20231121-05.gz
-rw-r----- 1 root adm 195 Nov 21 06:55 local-20231121-06.gz
-rw-r----- 1 root adm 198 Nov 21 07:55 local-20231121-07.gz
-rw-r----- 1 root adm 196 Nov 21 08:55 local-20231121-08.gz
-rw-r----- 1 root adm 193 Nov 21 09:55 local-20231121-09.gz
-rw-r----- 1 root adm 194 Nov 21 10:55 local-20231121-10.gz
-rw-r----- 1 root adm 192 Nov 21 11:55 local-20231121-11.gz
-rw-r----- 1 root adm 193 Nov 21 12:55 local-20231121-12.gz
-rw-r----- 1 root adm 196 Nov 21 13:55 local-20231121-13.gz
-rw-r----- 1 root adm 190 Nov 21 14:55 local-20231121-14.gz
-rw-r----- 1 root adm 192 Nov 21 15:55 local-20231121-15.gz
-rw-r----- 1 root adm 197 Nov 21 16:55 local-20231121-16.gz
-rw-r----- 1 root adm 194 Nov 21 17:55 local-20231121-17.gz
-rw-r----- 1 root adm 195 Nov 21 18:55 local-20231121-18.gz
-rw-r----- 1 root adm 196 Nov 21 19:55 local-20231121-19.gz
-rw-r----- 1 root adm 195 Nov 21 20:55 local-20231121-20.gz
-rw-r----- 1 root adm 198 Nov 21 21:55 local-20231121-21.gz

The local file was rotated and compressed every hour, and files older than one day have been deleted automatically, as configured.

Leave a Reply