s3-waf: convert REG_EVENTLOG into a subsystem.