default to syslog in production - #3886