syslog: distinguish between /proc/kmsg and syscalls