/var/log/csm/monitor.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
    create 0640 root root
}

# Audit-log JSONL stream consumed by SIEM shippers (Vector, Filebeat,
# Fluentbit). copytruncate keeps the daemon's open fd valid across
# rotation -- no SIGHUP needed, no risk of writing to an unlinked
# inode.
/var/log/csm/audit.jsonl {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
    create 0640 root root
}
