njoylif
Perhaps a more desirable method. Cisco devices can use a filtering facility to send the syslog when some leaves conf t session, but ONLY that syslog message. Send that over to your Orion. Add in a processing rule after you trigger the RTCD action to event log it, then delete it. Keep your syslog table clean.
edit:
Since I am likely about to be asked - this is what would go in your Cisco configs to do this:
Logging discriminator ConfgChg msg-body includes "Configured from"
Logging host <enter SolarWinds IP Address here> discriminator ConfgChg
ConfgChg can be any value you want it to be, it is just a name. You could do "SolarWindsRTCD" if you wanted.