https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog

sudo vi /etc/rsyslog.d/50-default.conf

*.*;auth,authpriv.none     ->     -/var/log/syslog

sudo systemctl restart rsyslog

sudo cp /etc/logrotate.d/rsyslog /etc/logrotate.d/rsyslog.bak-$(date +%Y%m%d) && \
sudo sed -i 's/^\trotate 4/\trotate 2/; s/^\tweekly/\tdaily/' /etc/logrotate.d/rsyslog

What it does:
1. Backs up the original config to /etc/logrotate.d/rsyslog.bak-20260812 before touching anything.
2. sed -i does two in-place replacements inside /etc/logrotate.d/rsyslog:
  - rotate 4 ? rotate 2 (keep 2 rotated copies instead of 4)
  - weekly ? daily (rotate once a day instead of once a week)

Resulting block in /etc/logrotate.d/rsyslog:
/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
      rotate 2
      daily
      missingok
      notifempty
      compress
      delaycompress
      sharedscripts
      postrotate
              /usr/lib/rsyslog/rsyslog-rotate
      endscript
}

I validated it afterward with sudo logrotate -d /etc/logrotate.d/rsyslog (dry-run, no changes) to confirm it parses correctly. It's picked up automatically by logrotate.timer, which runs daily at 00:00 UTC — no service restart needed.