-%attr(640,root,logs) %ghost /var/log/*
-/lib/systemd/system/rsyslog.service
+%attr(640,root,logs) %ghost /var/log/cron
+%attr(640,root,logs) %ghost /var/log/daemon
+%attr(640,root,logs) %ghost /var/log/debug
+%attr(640,root,logs) %ghost /var/log/kernel
+%attr(640,root,logs) %ghost /var/log/lpr
+%attr(640,root,logs) %ghost /var/log/maillog
+%attr(640,root,logs) %ghost /var/log/messages
+%attr(640,root,logs) %ghost /var/log/secure
+%attr(640,root,logs) %ghost /var/log/spooler
+%attr(640,root,logs) %ghost /var/log/syslog
+%attr(640,root,logs) %ghost /var/log/user
+%{systemdunitdir}/rsyslog.service