/var/log/shorewall {
  missingok
  notifempty
  create 0600 root root
}