fix failing syslog test

also adds ffi spec for failure