When mongod logs to syslog each entry looks like this:

2018-02-19T18:32:16.955448+00:00 hostname mongod.27017[116540]: [conn6362] Successfully authenticated as principal mms-monitoring-agent on admin

This lacks useful information that is present in mongod log files:

• component
• severity
• mongod-generated timestamp - the timestamp is generated by the syslog facility, which means
  • depending on how the customer has configured their system, it may lack millisecond precision and timezone; and may be in a difficult-to-parse, locale-dependent format
  • more significantly, it's generated by syslog on receipt of the log line, so under heavy load the syslog timestamp can differ very significantly from the time when the event occured (by tens of seconds or more), making diagnosis of events impossible

It would be helpful if the log line handed to the syslog facility was identical to the line logged in mongod log files. For example:

2018-02-19T18:32:16.955448+00:00 hostname mongod.27017[116540]: 2018-03-27T15:12:21.570-0400 I EXECUTOR [worker-controller] Target MaxQueueLatencyMicros (100μs) is less than minimum timer resolution of OS (10000000ns). Using 10000000ns

This would provide the missing information, and would make writing tools to consume log files much easier.