rsyslog forwards auth.log sshd login records to a remote server but not mail authentication attempt records (dovecot:auth) or sudo command records. All mail.log records are forwarded as expected.
10-rsyslog.conf contains entries for both mail and auth logs files:
mail.* @@hostname:514 auth.* @@hostname:514
Noticed that postfix mail.log records appear in the /var/log/syslog file but not the auth.log records.
Is there a separate configuration setting to forward mail server authentication attempt/failure and sudo command records?