syslog-ng with logsurfer versus rsyslog with logcheck for real-time alert throttling on Artix OpenRC

Goal: configure low-noise syslog alerting on an Artix Linux OpenRC installation without relying on systemd-journald, while suppressing repeated messages and delivering real-time alerts.

Constraint: Artix is systemd-free by default, so journalctl-based alerting is not the assumed path. syslog-ng with logsurfer provides stateful pattern matching and throttling, but its rule syntax is version-sensitive and easy to miswrite. rsyslog with logcheck offers simpler rule-based daily summaries and ignore/violation classification, yet is less suited to real-time throttling. Package availability differs by Artix edition, and messages emitted before the syslog daemon starts may be lost unless captured by klogd/dmesg or init-specific logging. This early-boot gap is not uniformly documented across OpenRC, runit, s6, and dinit variants.

Questions: which combination better fits real-time throttling on OpenRC, syslog-ng with logsurfer or rsyslog with logcheck? Should early-boot capture be added per init variant, and is that gap significant enough to change the alerting design?