The owner of all log files written by
rsyslog should be
syslog.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
For each log file LOGFILE referenced in /etc/rsyslog.conf,
run the following command to inspect the file's owner:
$ ls -l LOGFILE
If the owner is not
syslog,
run the following command to
correct this:
$ sudo chown syslog LOGFILE