problem learning from syslog