@jaredl: Looks like you are talking about using

rsyslog

as a sink for your osquery logs, not a source for the

syslog_events

table, correct?