I hadn't removed the spool file. If I remove it (/var/spool/rsyslog/machine-0) and restart rsyslog, I can get it to reliably write the file when the directory is owned by syslog:adm, and not when owned by root:root.
I hadn't removed the spool file. If I remove it (/var/spool/ rsyslog/ machine- 0) and restart rsyslog, I can get it to reliably write the file when the directory is owned by syslog:adm, and not when owned by root:root.