construct syslog debug level

in order to help with not overloading logstash, filter out events
that we consider debug level in syslog. This constructs 2 log
sevs by heuristic. All proxy-server and tgtd lines are considered
debug. tgtd definitely is, and proxy-server is overrun with
ceilometer accounting that it becomes unusable.

Everything else is considered INFO.

Includes tests and everything.

Change-Id: Ib1e07edee8396521fd6ff95e089f7ecf960f0172