Hi,
I have set <logall>yes</logall> in ossec.conf, everything was working fine, logs were compressed and moved to archives,
However I've noticed that for last few days, logs are moved to archive however not compressed at all, maybe it is due to the size of it?
Previously daily size of archives.log was 300MB and now daily archive.log is 3-15GB.
# ls -lah
-rw-r-----. 1 ossec ossec 2.6G Aug 7 23:59 ossec-archive-07.log
-rw-r-----. 1 ossec ossec 6.7G Aug 8 23:59 ossec-archive-08.log
-rw-r-----. 2 ossec ossec 3.7G Aug 9 14:13 ossec-archive-09.log
Can someone clarify on it please, much apreciated.