I believe it's all or nothing, but there is a way to say only logged added/newly returned criteria. For syslog specifically I'm not sure