Create watchThread after rsyslog forks

Move creation of the watchThread to after rsyslog forks, so the thread
isn't terminating when the fork happens.

Fixes bug 1096155