>>> I prefer to writing to local file system and to scp logs at midnight
>>> to
>>> central host.

I'm doing the same thing, but in the process of switching from syslog
to syslog-ng, due to the fact that one can use tcp with guaranteed
delivery. Also, you can log to multiple destinations at once (local
and multiple remote for redundancy purposes). Some customers have
requested 'near-realtime' stats on their usage, and this is the only
way to do it (the remote hosts are expendable and don't actually do
anything with the data besides show running stats).

Cheers
Kon