can we see what your rsyslog and osquery launchd files look like ?