test read permissions for syslog:
sudo -u openobserve-agent test -r /var/log/syslog; echo $?
shove this into install.sh somewhere:
setfacl -R -m u:openobserve-agent:rx /var/log/
shove this into uninstall.sh somewhere:
setfacl -R -x u:openobserve-agent /var/log/
double check:
getfacl /var/log