the syslog event expiry did help though