untar syslogs at the correct location