Resolved an issue in the main rsyslog regex - was missing the service, causing the entire line to be misclassified as a generic log and parsed as DAD events