ModSecurity Log Rotation with Splunk Indexing Issues

Issue

• When using rotatelogs to rotate ModSecurity audit logs hourly, Splunk encounters issues indexing the rotated log files because they do not start with the required SecAuditLogParts A section. This prevents Splunk from properly parsing and indexing ModSecurity logs.