Split out event log sink from syslog sink