On Monday, November 23, 2020 9:21:56 AM EST Andreas Hasenack wrote: Rotation is different than excess log checks. Log size checking is done every write. But this is only done when the daemon is not in debug mode and write_logs is not 0 and max_log_size_action is rotate and num_logs > 1. Every 3 writes. Generally people fall into 3 camps. The first camp is they correctly configure the native implementation and just use it. The second camp need something special. They either set max_log_size_action to keeplogs and then handle it on a cron job where that may use checkpointing. And yet another group just sends events to syslog and handle it via splunk or elastic search. -Steve