we already use rsyslog for our Linux infra and that's working perfectly fine. so yea my effort is focused only on OSQuery + Rsyslog with Mac for now