improvements for syslog_drain