You should setup a syslog-ng install, send the syslog messages to it and then forward them to zenoss.

If the devices are capable of sending syslog messages, then syslog-ng will work.  Syslog-ng is an open-source re-write of the original syslog daemon.  It features a good log filtering mechanism.  It is easy to learn how to build the filters.  I use it to accept log messgaes from network devices of all sorts and forward the messages to the appropriate NMS platforms.  It is in active development.

phonegi,  I'm running syslog-ng on RHEL3 and RHEL5 systems with no problems.  I'm not aware of any restriction that would prevent syslog-ng from running on RHEL.  In my environment, I have a dedicated system for syslog-ng, which forwards the events to Zenoss on a separate platform (also RHEL5).

What would take some work, and is what you've probably done, is running Zenoss and syslog-ng on the same system.  The major work would be to determine port settings so that syslog-ng gets the syslog events and forwards them to Zenoss which would listen on a different port.

I agree.  Thanks for the clarification.

There is an option, spoof-source, in syslog-ng to have it forward the message and use the source address of the original system that generated the syslog message.  Some syslog systems require this.  I had to rebuild syslog-ng using '../configure --enable-spoof-source' to have it support this option, then the config file needs the destination configuration to specify that source spoofing should be used:

destination d_zenoss { udp("10.9.9.9" spoof_source(yes)); };

Even with this enabled in my syslog-ng, Zenoss worked best for me when I enabled the 'parsehost' option in the zensyslog daemon.