Use /var/log/auth.log and kern.log
diff --git a/rsyslog/map.jinja b/rsyslog/map.jinja
index ca1af7a..e88c665 100644
--- a/rsyslog/map.jinja
+++ b/rsyslog/map.jinja
@@ -32,7 +32,7 @@
         createmode: "0640"
         umask: "0022"
         enabled: true
-      /var/log/auth:
+      /var/log/auth.log:
         sync: true
         filter: "auth,authpriv.*"
         owner: syslog
@@ -40,7 +40,7 @@
         createmode: "0640"
         umask: "0022"
         enabled: true
-      /var/log/kern:
+      /var/log/kern.log:
         sync: false
         filter: "kern.*"
         owner: syslog