I'm seeing this issue only on thorslaves, and not on thormasters.
It is present in all of USLM as well as Boca Prod400. On Nov 18th we upgraded Boca Prod to 5.4.4. Following that upgrade backupnode began logging to /var/log/HPCCSystems/backupnode/var/log/HPCCSystems/backupnode/ instead of the correct /var/log/HPCCSystems/backupnode
The only symlink in the entire path is /var/log -> /mnt/disk1/var/log, no other accidental symlink loops are present.
10.241.30.1 is an example.