The following message appears in auth log:
rsyslogd: action 'login_duo' treated as ':omusrmsg:login_duo' - please use ':omusrmsg:login_duo' syntax instead, 'login_duo' will not be supported in the future [v8.2001.0 try https://www.rsyslog.com/e/2184 ]
Probably a good idea to test and update this syntax accordingly.