"only send auth,authpriv to the pipe vs. all syslog", @coffee - Do you mean in the rsyslog config? Or on the osquery side?