you're right, it should not be an edition of rsyslog.conf because this is specific to Rudder. Instead, it seems more logical to edit rsyslog.d/rudder.conf. Do you agree ?

I'm not sure that using  a replacement is necessary on the edition of rsyslog.d/rudder.conf