-- work es root --

su zimbra
zmcontrol stop

-- work es root --
killall tail
look for all mounted /dev/shm (multiple mounts possible), umount them

Check the permissions for /var/log/zimbra.log. It's the owner zimbra and rw? Change them if necessary
Check also the size. It's zero byte? --> Bug 1

Have you make any changes in your /etc/syslog-ng/syslog-ng.conf? Yes?
Copy the zimbra changes from "/etc/syslog-ng/syslog-ng.conf.in" to "/etc/syslog-ng/syslog-ng.conf" (the last 5 lines with "#zimbra" comment at end)

Bug 1: Change the line with "killall -HUP syslogd" in this files to "/sbin/rcsyslog restart"

/opt/zimbra/bin/zmsyslogsetup
/opt/zimbra/bin/zmlogrotate
/etc/logrotate.d/zimbra

Restart syslog-ng with: "/sbin/rcsyslog restart"
mount -a
su zimbra
start zimbra (zmcontrol start)