# Rotation for the agent's root-owned logs under /var/log/imunify360/,
# replacing the in-process RotatingCompressionFileHandler.
#
# Only root-owned paths are listed here. Non-root invocations (e.g. CageFS
# user contexts) route logs to per-user dirs under
# /var/log/imunify360_user_logs/<user>/ that are owned by the unprivileged
# user. Rotating those from root's logrotate would let the user redirect
# root's create/copy/truncate via a symlink (a logrotten-style privilege
# escalation), so they are deliberately excluded and bounded in-process
# instead — see defence360agent/internals/logger.py.
#
# Uses copytruncate so the agent's open fd remains valid across rotation
# (same inode, just truncated) — no postrotate signal needed and no risk
# of the agent writing into a renamed/deleted file. The brief copy↔truncate
# window may drop a handful of bytes under heavy logging; acceptable for
# debug logs.
#
# Shipped by imunify-core because the agent code (defence360agent) that
# writes these files is shipped by imunify-core; this keeps the rotation
# config co-located with the writer for both Imunify360 and ImunifyAV
# installations.
#
# error.log is intentionally NOT listed here: the Go resident agent
# (src/resident-agent/errorlog.go) owns rotation for that file with its
# own size-based rename chain. Letting logrotate also touch error.log
# means two writers compete on error.log.{1,2,...}.gz, and the Go agent's
# next rotate() copyFile(error.log, error.log.1) would clobber an
# uncompressed archive that logrotate had just produced under
# `delaycompress`.
/var/log/imunify360/network.log
/var/log/imunify360/debug.log
/var/log/imunify360/console.log
/var/log/imunify360/hook.log
/var/log/imunify360/process_message.log
/var/log/imunify360/acronis-installer.log
{
daily
maxsize 60M
rotate 5
# Drop archives older than 30 days regardless of position. This also
# eventually purges leftovers from the old in-process rotation
# (console.log.6.gz, console.log.7.gz, ...) that the fixed rename
# chain never touched.
maxage 30
missingok
notifempty
compress
delaycompress
copytruncate
}
