Yeah, sorry I wasn't clear on that, we have osquery configured with the

--logger_plugin=syslog

flag and it appears that after deploying it (and after some time) rsyslog gets into this state.