In T182497, we discovered that ORES logs are being sent to syslog, using a custom formatter. We don't know where that's coming from, we have a logging_config.yaml that explicitly sends all logging to a file.
This can be reproduced in our vagrant role. Debug and fix logging to only send to ores.log.
This might be a good opportunity to provide an /etc/ores override location for logging config, so that puppet doesn't have to write into a source-controlled directory.