/var/lib/ossec/logs/active-responses.log {
    missingok
    notifempty
    su ossec ossec
}

/var/lib/ossec/logs/ossec.log {
    missingok
    notifempty
    su ossec ossec
}

