/var/ossec/logs/active-responses.log {
    missingok
    notifempty
}

