mjhjmtu

To rotate logs after the size grows to 1M, cronjob invokes logrotate every 15 mins, as shown below:

0,15,30,45 * * * * /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf

where syslog-ng-rotate.conf is

/app/syslog-ng/custom/output/all_devices.log 
size 1M
copytruncate
dateext
dateformat -%Y%m%d-%s
rotate 365
sharedscripts
compress
postrotate
 /app/syslog-ng/sbin/syslog-ng-ctl reload
endscript

But the above configuration does not work if file size crosses 1M within 15 minutes.

How to make sure, that file gets rotated immediately after the file size goes to 1M?

logrotate only runs when you tell it to run. If you have a log file that may grow quickly, and you're using cron, I have two suggestions:

1. 
   

   schedule the cron job more frequently (say, every minute):

   
   
   

   * * * * * /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf
   

   
   
   

   so that you have at most 60 seconds for the log file to grow before possibly reaching the size limit.

   
   


2. 
   

   If your log file is still growing too quickly each minute, then run logrotate multiple times within each minute; either one immediately after the other:

   
   
   

   * * * * * /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf
   

   
   
   

   (for example), or:

   
   
   

   * * * * * /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; sleep 10; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; sleep 10; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf
   

   
   
   

   ... to give 10 seconds between each call to logrotate. Note that you don't want any individual cron job to take more than 60 seconds, or you'll overlap into the next cron job. Consider wrapping the entire cron job with timeout:

   
   
   

   * * * * * timeout 59 sh -c "/usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; sleep 10; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf; sleep 10; /usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf"
   

   
   

You'd have to experiment with the timings and number of calls to logrotate for your environment to keep the log file under control.