syslog.conf check and caveat for auth logs