/var/ossec/logs/active-responses.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
}

/var/ossec/logs/ossec.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
        postrotate
            if command -v systemctl > /dev/null 2>/dev/null; then
                systemctl restart ossec-hids > /dev/null 2>/dev/null
            else
                /var/ossec/bin/ossec-control restart > /dev/null 2>/dev/null
            fi
    endscript
}