/var/log/audit/audit.log {
    monthly
    rotate 6
    compress
    delaycompress
    notifempty
    missingok
    create 0640 root adm
    postrotate
        /usr/bin/systemctl restart auditd.service >/dev/null 2>&1 || true
        /usr/bin/chmod 440 /var/log/audit/audit.log.* >/dev/null 2>&1 || true
    endscript
}
