My department has several linux computers and auditing the logs is very tiresome if they are all localized to each computer. While the vanilla syslog offers remote logging features it uses udp and thus many things can affect the chance of log messages reaching their destination. the message dropping problem is not as widespread in syslog-ng since it uses tcp to transmit log packets.
Compiling syslog-ng is required as the only syslog-ng binaries are licensed and require a contract to purchase. under rhel/centos the eventlog compilation goes as planed, but things start going wrong when auto configuring syslog-ng itself. it will complain. configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? this is a easy problem that can be fixed with running configure in the following way:
PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure –sysconfdir=/etc
this causes the syslog-ng.conf file to go to /etc/syslog-ng.conf and adhere to the layout choices of rhel/centos. ... Read More