Hi,
I don't remember posting this here, but should have some relevance. It explains how syslog-ng can be configured to support cee logs, and also a way to standardize that functionality in user configurations without too much hassle.
http://bazsi.blogs.balabit.com/2012/05/cee-prototype-and-a-show-case-for-...
Cheers.
--
Bazsi
