CCE-26801-1 - rsyslog suggestion/question