While searche why fluentd doesn t wor I found this entries in the fluentd container logs
2020-09-29 10:47:52 +0000 [warn]: #0 /var/lib/rancher/rke/log/etcd_065ff7161b0e6baa279055f7ef0a9bccdcd9d19e7b2143229d4066e31f0cb9a6.log unreadable. It is excluded and would be examined next time.
I found some hints online but shouldn t access be possible.
Ralf