That’s my other option too. Just wanted to see if it was any easier with rsyslog, so I didn’t have to deploy another agent.