The typical logging problem as viewed from syslog

I run into different syslog use cases from time to time. So I thought it is a good idea to express what I think the typical logging problem is. As I consider it the typical problem, syslog (and WinSyslog and rsyslog in specific) address most needs very well. What they spare is the analysis and correlation part, but other members of the family (like our log analyzer) and third parties care well for that.

So the typical logging problem, as seen from the syslog perspective, is:

1. there exists events that need to be logged
   
2. a single "higher-level" event E may consist of a
   number of fine-grained lower level events e_i
   
3. each of the e_i's may be on different
   systems / proxies
   
4. each e_i consists of a subset of properties
   p_j from a set of all possible common properties P
   
5. in order to gain higher-level knowledge, the
   high-level event E must be reconstructed from
   e_i's obtained from *various* sources
   
6. a transport mechanism must exist to move event
   e_i records from one system to another, e.g., to
   a central correlator
   
7. systems from many different suppliers may be involved,
   resulting in different syntax and semantic of
   the higher-level objects
   
8. there is potentially a massive amount of events
   
9. events potentially need to be stored for
   an extended period of time
   
10. quick review of at least the current event data
    (today, past week) is often desired
    
11. there exists lots of noise data
    
12. the data needs to be fed into backend processes,
    like billing systems