ENH: filter.d/webmin anchor at start and use syslog