ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: etc / logrotate.d

# Rotation for the agent's root-owned logs under /var/log/imunify360/,
# replacing the in-process RotatingCompressionFileHandler.
#
# Only root-owned paths are listed here. Non-root invocations (e.g. CageFS
# user contexts) route logs to per-user dirs under
# /var/log/imunify360_user_logs/<user>/ that are owned by the unprivileged
# user. Rotating those from root's logrotate would let the user redirect
# root's create/copy/truncate via a symlink (a logrotten-style privilege
# escalation), so they are deliberately excluded and bounded in-process
# instead — see defence360agent/internals/logger.py.
#
# Uses copytruncate so the agent's open fd remains valid across rotation
# (same inode, just truncated) — no postrotate signal needed and no risk
# of the agent writing into a renamed/deleted file. The brief copy↔truncate
# window may drop a handful of bytes under heavy logging; acceptable for
# debug logs.
#
# Shipped by imunify-core because the agent code (defence360agent) that
# writes these files is shipped by imunify-core; this keeps the rotation
# config co-located with the writer for both Imunify360 and ImunifyAV
# installations.
#
# error.log is intentionally NOT listed here: the Go resident agent
# (src/resident-agent/errorlog.go) owns rotation for that file with its
# own size-based rename chain. Letting logrotate also touch error.log
# means two writers compete on error.log.{1,2,...}.gz, and the Go agent's
# next rotate() copyFile(error.log, error.log.1) would clobber an
# uncompressed archive that logrotate had just produced under
# `delaycompress`.
/var/log/imunify360/network.log
/var/log/imunify360/debug.log
/var/log/imunify360/console.log
/var/log/imunify360/hook.log
/var/log/imunify360/process_message.log
/var/log/imunify360/acronis-installer.log
{
    daily
    maxsize 60M
    rotate 5
    # Drop archives older than 30 days regardless of position. This also
    # eventually purges leftovers from the old in-process rotation
    # (console.log.6.gz, console.log.7.gz, ...) that the fixed rename
    # chain never touched.
    maxage 30

missingok
    notifempty

compress
    delaycompress

copytruncate
}

[-] unattended-upgrades [edit]
[-] alternatives [edit]
[-] ea-php80-php-fpm [edit]
[-] lfd [edit]
[-] rsyslog [edit]
[-] iptraf-ng [edit]
[-] cloud-init [edit]
[-] ufw [edit]
[-] bootlog [edit]
[-] nginx [edit]
[-] zabbix-agent [edit]
[-] apache [edit]
[-] exim [edit]
[-] wp-toolkit-action-logs [edit]
[-] ubuntu-pro-client [edit]
[-] imunify360-antivirus [edit]
[-] custom_php-fpm_error_log [edit]
[-] nscd_logs [edit]
[-] apt [edit]
[-] dpkg [edit]
[-] ea-php81-php-fpm [edit]
[-] imunify-core [edit]
[+] ..
[-] apport [edit]
[-] btmp [edit]
[-] modsecurity_logs [edit]
[-] ea-php82-php-fpm [edit]
[-] nghttpx [edit]
[-] ea-php74-php-fpm [edit]
[-] sw-engine [edit]
[-] wp-toolkit [edit]
[-] wtmp [edit]
[-] ea-php83-php-fpm [edit]