1 2 3 4 5
/var/lib/ossec-hids/logs/active-responses.log /var/lib/ossec-hids/logs/ossec.log { missingok notifempty copytruncate }