As far as I know, there's no way natively built-in to OSSEC. However, you can setup logrotate.d to accomplish this. It would pretty much work the same way any other logrotate works. Although, you may want to add a postscript in to make sure OSSEC is either killed/started or restarted.
On Mon, Nov 14, 2011 at 1:21 AM, Holger Gläß <[email protected]>wrote: > hi > > i there a possebility to rotate ossec.log too like alerts.log ? > > or just once per day ? > > holger >
