I'm assuming this is actually a client agent (as in, it talks to a server or servers operated by anomalous), but why would it be required anyway? It seems actual log lines are being uploaded to "anomalous" anyway? If it's just to reduce bandwidth, why isn't this just a plugin for rsyslog?