break out the patching for syslog into a separate step