I don't believe it is anything specific to syslog that is doing the expiration... That log line is from

osquery/events/events.cpp