Edit File: ossec-hids
/var/ossec/logs/active-responses.log { missingok notifempty copytruncate maxsize 100M rotate 7 create 0664 ossec ossec su ossec ossec } /var/ossec/logs/ossec.log { missingok notifempty copytruncate maxsize 100M rotate 7 create 0664 ossec ossec su ossec ossec postrotate if command -v systemctl > /dev/null 2>/dev/null; then systemctl restart ossec-hids > /dev/null 2>/dev/null else /var/ossec/bin/ossec-control restart > /dev/null 2>/dev/null fi endscript }