[ossec-list] Re: Problem with squid logs

[Emmanuel E.]

Hello! this happen only with access.log, the agent continues to send logs 
of /var/log/message and /var/log/secure. Sometimes when squid rotates the 
access.log, the agent starts to sends newly the logs. But other times, the 
agent continues without  sending the logs of access.log.
The logs of access.log rotate weekly automaticly with logrotate. The 
following shows the archive of configuration of logrotate to access.log:

less  /etc/logrotate.d/squid

/var/log/squid/access.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}
/var/log/squid/cache.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}

/var/log/squid/store.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
# This script asks squid to rotate its logs on its own.
# Restarting squid is a long process and it is not worth
# doing it just to rotate logs
    postrotate
      /usr/sbin/squid -k rotate
    endscript
}