move syslog ferm into syslog role