ok so I adjusted the

syslog_events_expiry

, and we are no longer seeing these:

W1025 19:10:01.643024 17547 events.cpp:304] Expiring events for subscriber: syslog limit (100000) exceeded: 100052