# ARGUS security-event ingestion + nginx logs (ADR-0038 Sec.2.5, ADR-0040 M7).
#
# Deliberately NOT copytruncate: internal/service/log_collector.go's tailer
# (streamFileAccessLogs / streamStreamAccessLogs) detects rotation by inode
# change and re-opens the new file at that path -- copytruncate keeps the
# same inode and truncates in place, which the tailer would never notice,
# silently stalling security-event ingestion until the file regrew past its
# old read offset. The default rename-then-create rotation this file uses
# instead changes the inode, which the tailer already handles correctly.
#
# All four files are written by the same argus-nginx worker process (nginx's
# own access/error logs, and ModSecurity's audit log via the same process),
# so one shared postrotate reload covers all of them.
/var/log/argus/access_raw.log
/var/log/argus/stream_access.log
/var/log/argus/modsec_audit.log
/var/log/argus/nginx-error.log {
    size 100M
    rotate 5
    missingok
    notifempty
    create 0644 argus argus
    sharedscripts
    compress
    delaycompress
    postrotate
        systemctl reload argus-nginx >/dev/null 2>&1 || true
    endscript
}
