I was able to get it working via Trap rules, instead of syslog. I can't remember if I attempted a syslog first, or if I went straight to the trap rule.
For the trap rule, I left everything default except for the "trap Details" tab. It took a little testing, and watching the traps to see what info was sent when a config change was made. Here is the Trap Details Pattern that seems to work for me:
*end configuration*,*Begin configuration:*reading from http [POST]* (Use Regular Expressions is Unchecked)
and of course I had to create an Alert action to trigger the download, just like you would with a syslog rule.
Hope that helps.