here’s some additional information:
I ran the following command: to see what files were in use:
lsof -p $(pgrep -f syslog) -a +D /var/log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1923 root 1w REG 249,0 6295945 793792 /var/log/secure
rsyslogd 1923 root 2w REG 249,0 2735194 793791 /var/log/messages
rsyslogd 1923 root 4w REG 249,0 2365 793790 /var/log/maillog
rsyslogd 1923 root 8w REG 249,0 244734 793785 /var/log/cron