just switched all my systems to use metalog rather than syslog-ng for system logs. Once you take the time to read the metalog docs, it's much more straightforward than the other loggers I've used.
plus it buffers all the output for ‘high performance’. the only real benefit I hope to achieve from that is that perhaps my laptop hard drive will stay turned off longer. when you need to debug something, you can turn off the buffering with ‘killall -USR1 metalog’ and back on with ‘killall -USR2 metalog’
anyway, the metalog page and my metalog.conf file