The following is a variation on the answer by @quixad with detailed steps (I've tested them on CentOS 6.9): Create file vi /etc/logrotate.d/Splunk_ACLs and populate with the logs you'd like to forward to splunk. /var/log/splunklog { postrotate /usr/bin/setfacl -m g:monitor:rx /var/log/cron /usr/bin/setfacl -m g:monitor:rx /var/log/maillog /usr/bin/setfacl -m g:monitor:rx /var/log/messages /usr/bin/setfacl -m g:monitor:rx /var/log/secure /usr/bin/setfacl -m g:monitor:rx /var/log/spooler /usr/bin/setfacl -m g:monitor:rx /var/log/php-fpm/error.log touch /var/log/splunklog endscript } Create a dummy log file to keep logrotate happy sudo touch /var/log/splunklog Test if the configuration is valid. You may want to create a copy of your configuration file first. sudo logrotate -vf Splunk_ACLs ... View more