# Decreasing Log Cycle Time

**URL:** <https://community.zeek.org/t/decreasing-log-cycle-time/5827>\
**Category:** Zeek\
**Created:** [September 4, 2019, 3:03pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827 "2019-09-04T15:03:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Gez](https://avatars.discourse-cdn.com/v4/letter/m/3ec8ea/32.png) [@Michael\_Gez](https://community.zeek.org/u/Michael_Gez)\
**Post date:** [September 4, 2019, 3:03pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827/1 "2019-09-04T15:03:20Z")

</div>

Hi all,

If I am not mistaken, Bro/Zeek cycles logs hourly.  
This cycle is causing some unpredictable behavior in my tailing algorithm.

If i could set it to cycle every 5 minutes rather than on the hour, it would be very beneficial to testing and resolving issues.  
Is there a way I can reduce the amount of time Bro takes in between log cycles?

Thanks!

---

<div class="post-metadata">

**Author:** ![peterhallin](https://avatars.discourse-cdn.com/v4/letter/p/a4c791/32.png) [@peterhallin](https://community.zeek.org/u/peterhallin)\
**Post date:** [September 4, 2019, 3:35pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827/2 "2019-09-04T15:35:46Z")

</div>

Hello Michael,

In your broctl.cfg file, you can set the rotation interval to 300  
seconds with:

LogRotationInterval = 300

Also, if you want to disable gzip on rotation, use this:

CompressLogs = 0

Brgds,

Peter

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [September 4, 2019, 3:36pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827/3 "2019-09-04T15:36:52Z")

</div>

Hi Michael,

You should be able to do this by changing the “LogRotationInterval” variable in /opt/bro/etc/broctl.cfg (assuming you installed bro in /opt/). By default it’s set to 3600 seconds (1 hour), so setting this to 300 should change this to 5 minutes. You’ll then have to stop Bro (broctl stop) and redeploy (broctl deploy) for the changes to take effect.

Hope that helps!  
Eric  
[ericooi.com](http://ericooi.com)

---

<div class="post-metadata">

**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\
**Post date:** [September 4, 2019, 4:11pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827/4 "2019-09-04T16:11:39Z")

</div>

In broctl.cfg, you can set

LogRotationInterval = 300

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/decreasing-log-cycle-time/5827/5 "2022-05-06T15:46:44Z")

</div>