/var/ossec/logs/active-responses.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
}

/var/ossec/logs/ossec.log {
    missingok
    notifempty
    copytruncate
    maxsize 100M
    rotate 7
    create 0664 ossec ossec
    su ossec ossec
        postrotate
        /var/ossec/bin/ossec-control restart > /dev/null 2>/dev/null
    endscript
}