Options:
 --listen, -l      Frontend socket to listen to syslog connections on (/dev/log)
 --connect, -c     Backend socket to connect to real syslog daemon (/dev/logwall)
 --rules, -r       File to read event-level rules from (/etc/logwall/rules)
 --stream-rules    File to read stream-level rules from (/etc/logwall/stream-rules)
 --pidfile, -P     File to write PID into (/var/run/logwall.pid)
 --statsfile, -S   File to write and update statistics in JSON format into (/var/run/shm/logwall-stats.json)
 --stats-write-min-interval  Minimum amount of seconds to wait between flush stats file (1)
 --fifo, -f        Fifo specifications (see below) to listen to raw log messages on
 --quiet, -q       Output less messages at start
 --configtest, -t  Run normally but evaluate all test terms in all rules to test the configuration syntax
 
Fifo syntax: "NICKNAME:OWNER:GROUP:MODE:FILEPATH", where
 Messages coming in on this fifo can be matched by "fifonick==NICKNAME".
 NICKNAME must start with alphanum or empty, in latter case basename of FILEPATH will be used.
 OWNER and GROUP are system user- and groupname, or UID and GID, or -1.
 MODE defaults to 0666. FILEPATH will be created and opened for read.