I am not an ops person, but my understanding is that rsyslog does 'store and forward', which would allow replaying of the log if something was dropped: http://www.rsyslog.com/storing-and-forwarding-remote-message...