I've thought about this a bit and ideally one could either use a compressor with a predefined dict populated with normal daemon syslog output and output based o

I've thought about this a bit and ideally one could either use a compressor with a predefined dict populated with normal daemon syslog output and output based on bad compression ratio of syslog messages or use minwise hashing and have a learning mode to populate a 'good' table and similar to the compression close jaccard similarities get discarded.