@pirxthepilot afaik osquery does not have that feature intentionally. there's a logrotate template you can use here: https://github.com/facebook/osquery/issues/302