I am working on moving logging from sysklogd based program to rsyslog.
Someone was very good to write a nice module and I have tested it on a
couple of boxes to see if it works. The logging will use the TCP
method and I will be setting up spools for logs to backup if the
system can't get to log01 for a bit. [Thanks to the person who did
this in the past.. I started on my own, and this is so much nicer. I
will be rewriting the ntpd to match it.]
One of the issues that has cropped up over the last year is that we
have logs spread around many directories. Some of them are due to how
rsyslog has reverse mapped a system (if it didn't have a name it got
an ip address..), sometimes due to the move
was used for a while until it wasn't.)
and sometimes due to goodness knows what
(xen14.phx2.fedoraproject.org's logs match up mostly with xen14's
logs.. so it was logging as two boxes at the same time (except when it
wasn't.).). I am currently manually going through the logs and making
them more consistent.. I should have it done by early next week.
After that time I should start work on moving more systems to using
rsyslog and we will go from there.
 rsyslog allows for TCP which allows for logs to be less lossy during load.
Stephen J Smoogen.
Ah, but a man's reach should exceed his grasp. Or what's a heaven for?
-- Robert Browning