The contents of the log are not filtered correctly and the response payload may contain either messages from older MaxScale versions with a different log message structure or from the audit daemon if MaxScale has crashed or hits a debug assertion.

Currently the matching is done by filtering with _COMM=maxscale but this will also include any auditing messages logged for the MaxScale process. The correct thing would be to also filter on the SYSLOG_IDENTIFIER field to make sure only matching messages are logged. Matching both _COMM and SYSLOG_IDENTIGIER avoids the problem where something other than MaxScale is using the maxscale syslog identifier.