/var/ossec/logs/active-responses.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
}

/var/ossec/logs/ossec.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
        postrotate
        if service ossec-hids status > /dev/null ; then \
            service ossec-hids restart > /dev/null; \
        fi;
    endscript
}
