collector should run as vcap user
local syslog aggregators should drop root permissions