Ubuntu 22.04 All syslog log files should have appropriate ownership. /etc/rsyslog.conf ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ 1 var_rsyslog_files_groupownership_include_config_regex ^/etc/rsyslog.conf$ var_rsyslog_files_groupownership_syslog_config object_var_rsyslog_files_groupownership_include_config_regex object_var_rsyslog_files_groupownership_syslog_config ^\s*[^#$].*?(?:\b[Ff]ile="([^"\s]+)"|[\s]+-?(\/[^:;\s]+)).*$ 1 state_rsyslog_files_groupownership_ignore_include_paths (?:include\([\n\s]*\b[Ff]ile="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|^\s+\b[Ff]ile="|\/dev\/.*) /etc/group ^adm:\w+:(\w+):.* 1 regular