It seems that part of the issue is described in bug #1861881.
I was able to get a working log file while excluding the entries from syslog by:
- removing the content from /etc/rsyslog.d/tomcat.conf (leaving blank file to prevent reinstatement by auto patching)
- putting the content in /etc/rsyslog.d/12-tomcat9.conf (to ensure it was loaded before 50-default.conf)
- amending the path from /var/log/tomcat9/catalina.out to /var/log/tomcat.log to avoid the permissions issue (/var/log/tomcat9 is not writeable by the syslog user)
- adding a new /etc/logrotate.d file with content below....
/var/log/tomcat.log
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}