/var/log/krb5kdc.log {
missingok
notifempty
monthly
rotate 12
postrotate
systemctl reload krb5kdc.service || true
endscript
}