Agreed, I was pretty disappointed to see that security events are not currently in scope of the syslog function. Failed/successful logins, IP source etc. are all valuable in a SIEM for data correlation and event timelining. Can we please have these added ?