rsyslog path is /var/log/aggregated/