# Shipped by nuxpbx as /etc/logrotate.d/nuxpbx. The two files that are ours;
# the distribution's own asterisk snippet keeps the rest.
#
# /var/log/asterisk/security exists because nuxpbx names that channel in the
# logger.conf it writes. Asterisk generates the events either way and drops
# them where no file is named, so this file is ours even though Asterisk
# writes it, and the SIP jail reads nothing else. Neither distribution rotates
# it: Debian's asterisk snippet names debug, messages, full and *_log, Alpine's
# names messages and *log, and "security" ends in none of those. On a machine
# on the internet a refused registration is written every few seconds, so the
# one file that grows without bound is the one written because somebody is
# guessing at the box, on an ISO and a VM image whose whole disk is 8 GB.
#
# /var/log/nuxpbx.log is the daemon's whole output on Alpine, where the OpenRC
# service sends it there and nothing else ever touches it. On Debian the daemon
# writes to the journal, which rotates itself, so the name is simply missing
# and missingok says as much.

/var/log/asterisk/security
/var/log/nuxpbx.log
{
	daily
	rotate 14
	missingok
	notifempty
	compress
	delaycompress
	# Copy and truncate rather than rename and tell the writer to reopen.
	# Asterisk reopens its log only when its logger is reloaded and the
	# OpenRC service has no way to reopen at all, so a rename leaves both
	# writing into a file nobody reads afterwards. fail2ban reads a file
	# that shrank as a file that started again, so the jail follows.
	#
	# ponytail: the cost is the handful of lines written between the copy
	# and the truncate, once a day. A reload of Asterisk's logger in a
	# postrotate would save them and couple this to the engine being up.
	copytruncate
}
