# High-volume third-party logs are isolated in /var/log/volatile tmpfs.
/var/log/volatile/suricata/*.log /var/log/volatile/suricata/*.json /var/log/volatile/suricata/*.pcap /var/log/volatile/suricata-mitm/*.log /var/log/volatile/suricata-mitm/*.json /var/log/volatile/suricata-mitm/*.pcap {
    rotate 1
    maxsize 32M
    nocompress
    missingok
    notifempty
    create 0640 root adm
    sharedscripts
    postrotate
        for pidfile in /run/suricata.pid /run/suricata_mitm.pid /var/run/suricata.pid /var/run/suricata_mitm.pid; do
            [ -s "$pidfile" ] && /bin/kill -HUP "$(cat "$pidfile")" >/dev/null 2>&1 || true
        done
    endscript
}

/var/log/volatile/sslproxy/*.log /var/log/volatile/suricata-aggregator.log /var/log/volatile/suricata-aggregator.service.log {
    rotate 1
    maxsize 32M
    nocompress
    missingok
    notifempty
    copytruncate
    nocreate
}

/var/log/volatile/nginx/*.log /var/log/volatile/harresi_webui.log /var/log/volatile/suricata-monitor.log {
    rotate 1
    maxsize 8M
    nocompress
    missingok
    notifempty
    copytruncate
    nocreate
}
