/var/log/harresi/audit/auditd/audit.log {
    rotate 1
    nocompress
    missingok
    notifempty
    create 0600 root root
    sharedscripts
    postrotate
        /usr/sbin/service auditd rotate >/dev/null 2>&1 || /bin/systemctl kill -s USR1 auditd.service >/dev/null 2>&1 || true
    endscript
}

/var/log/harresi/audit/product/audit-product.log /var/log/harresi/audit/product/ids-ips-events.log {
    rotate 1
    maxsize 32M
    nocompress
    missingok
    notifempty
    copytruncate
    nocreate
    sharedscripts
    postrotate
        /bin/systemctl reload rsyslog >/dev/null 2>&1 || true
    endscript
}
