Hello I have a similar problem as discussed in /var/log/account/pacct is getting too big, where is ckpacct (to cicle/gzip it)?
While the problem exists it would be preferable to compress the logs hourly instead of daily. I put a workaround in place with the following commands:
# Keep the same amount of log data: 30 days * 24 hours = 720.
sudo sed -i -e 's/\(ACCT_LOGGING=\)\("30"\)/#\1\2\n\1"720"/' /etc/default/acct
# Execute logrotate hourly instead of daily.
sudo mv -v /etc/cron.daily/acct /etc/cron.hourly/
That works, so far so good. But, uh this feels very clunky. I could go further to deny package updates to create the file again or pin the package, but it begs the question: Someone else has probably seen this and come up with a more modern solution to the hacks and hard coded values from 20 years ago found in the acct package and I'm just making it worse by adding more shell code and moving files.
