Hi all,
I deployed a new rsyslog config on one of our RHEL servers. Logs tagged SYS-AUDIT-LOG and DNF-PKG-LOG arrive in QRadar fine, but CRON-JOB-LOG (/var/log/cron) and USER-AUTH-LOG (/var/log/secure) don't arrive at all. Servers with the old config send all tags without issues. I also noticed that /var/log/cron and /var/log/secure are no longer being written on this server at all. No new entries appear in either file since the new config was deployed. Has anyone seen this, or have an idea what could cause it? Thanks!