/var/log/suricata/*.log /var/log/suricata/*.json /var/log/suricata/*.pcap {
    rotate 1
    compress
    missingok
    notifempty
    create 0640 root adm
    sharedscripts
    postrotate
        for pidfile in /run/suricata.pid /var/run/suricata.pid; do
            [ -s "$pidfile" ] && /bin/kill -HUP "$(cat "$pidfile")" >/dev/null 2>&1 || true
        done
    endscript
}
