osQuery Management Server (Prime).Audit Logging Configurations (SQLite SQL Statements)

          SELECT 
            pid, 
            name, 
            path, 
            cmdline
          FROM processes
          WHERE 
            name LIKE '%syslog%' 
            OR name LIKE '%rsyslog%' 
            OR name LIKE '%syslog-ng%';