THE DON FAY SHELL

✏️ Editing: imunify-core

# DEF-26794: agent log rotation, replacing the in-process
# RotatingCompressionFileHandler.
#
# Uses copytruncate so the agent's open fd remains valid across rotation
# (same inode, just truncated) — no postrotate signal needed and no risk
# of the agent writing into a renamed/deleted file. The brief copy↔truncate
# window may drop a handful of bytes under heavy logging; acceptable for
# debug logs.
#
# Shipped by imunify-core because the agent code (defence360agent) that
# writes these files is shipped by imunify-core; this keeps the rotation
# config co-located with the writer for both Imunify360 and ImunifyAV
# installations.
#
# error.log is intentionally NOT listed here: the Go resident agent
# (src/resident-agent/errorlog.go) owns rotation for that file with its
# own size-based rename chain. Letting logrotate also touch error.log
# means two writers compete on error.log.{1,2,...}.gz, and the Go agent's
# next rotate() copyFile(error.log, error.log.1) would clobber an
# uncompressed archive that logrotate had just produced under
# `delaycompress`.
/var/log/imunify360/network.log
/var/log/imunify360/debug.log
/var/log/imunify360/console.log
/var/log/imunify360/hook.log
/var/log/imunify360/process_message.log
/var/log/imunify360/acronis-installer.log
# Non-root invocations (e.g. CageFS user contexts) route logs to a
# per-user directory; the previous in-process handler enforced size
# limits there too, so cover them with the same policy. The Go resident
# agent only runs as root and never writes to these paths, so no
# dual-rotation conflict applies — `error.log` is safe to include here.
/var/log/imunify360_user_logs/*/*.log {
    daily
    maxsize 60M
    rotate 5
    # Drop archives older than 30 days regardless of position. This also
    # eventually purges leftovers from the old in-process rotation
    # (console.log.6.gz, console.log.7.gz, ...) that the fixed rename
    # chain never touched.
    maxage 30

missingok
    notifempty

compress
    delaycompress

copytruncate
}