only handle latest 1 hour log
record syslog atime(mtime)