On May 26, 2009, at 9:31 AM, "Tal Cohen" <wlug@cohen123.com> wrote:

I'm trying to setup a secondary log rotation mechanism on on of my production systems.

Right now, the system is setup to rotate logs on a weekly basis.

In addition to the weekly log rotation, I also need to take hourly snapshots (i.e. just the deltas between snapshots).

Is the weekly rotation really needed, or do you just need to retain a certain amount of data?

Switching to hourly rotation and retaining a weeks worth or more of data would be the simplest solution.

As part of this process, I can not delete the original file since that is being handled by the weekly log rotation and archival process.

These files get pretty big, so IO and CPU are both concerns.

Do you have plenty of space? If you do you can have syslog log the data into two files, one with a weekly rotation and one daily.

Greg