Is this maybe related to #720096 and #831764 ? logrotate calling the rsyslog-rotate wrapper twice (one time for /var/log/syslog and another time for the rest (/var/log/mail.* etc.)) and the second time rsyslog is not (yet) ready to receive the SIGHUP ?