@zwass is the expert, but here're the docs https://osquery.readthedocs.io/en/stable/deployment/syslog/ I have no insight if that applies to 10.12 differently