As far as I know, OSSEC itself doesn't delete logs. Look at the documentation
Where are OSSEC’s logs stored?¶
On OSSEC server and local installs there are several classes of OSSEC
logs. There are the logs created by the OSSEC daemons, the log
messages from the agents, and the alerts. Agent installs do not have
logs from other agents or alerts, but do have logs created by the
All logs are stored in subdirectories of /var/ossec/logs. OSSEC’s log messages are stored in /var/ossec/logs/ossec.log.
Log messages from the agents are not stored by default. After analysis they are deleted unless the option is included in
the manager’s ossec.conf. If set all log messages sent to the manager
are stored in /var/ossec/logs/archives/archives.log and rotated daily.
Alerts are stored in /var/ossec/logs/alerts/alerts.log, and rotated daily.
You can use logrotate to rotate the ossec logs, but the
/var/ossec/queue/diff folder is another story.
You can safely delete the files in there and maintain OSSEC functionality, but you will lose the difference reports.