hah, crazy, found the root cause. we’re doing snapshots for rpm_packages and instead of logging one package per line, it creates one massive json object that is too big for syslog