And from that comment I take it you can't put osquery on the hosts that are generating the syslog?