@czanik if you'd like to update the docs, you could do so by creating a Pull Request directly through the Github API here: https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/syslog.md. If you're not up for that, I can make an update with your syslog-ng template.