file rotation for 'file_output'

[krishnaghatti]

Hello all,

I am using file_output with the below settings. Is there any way we can set rotation of the file after it reaches a specific size or time (rotate once every day)

file_output:
enabled: true
filename: /var/log/falco/events.txt

[finid]

On Ubuntu and maybe other distros too, you can use the installed Logrotate program. See /etc/logrotate.d and /etc/logrotate.conf.

By the way, my config is just like yours.

[mstemm]

#347 will have an example logrotate config. Also, it modifies falco to close/reopen file and program outputs on SIGUSR1. This is relevant when using keep_alive: true, as the output file/program is kept open across outputs.