Just an humble advice about transferring logs.

First, did you consider the option to replicate your logs to another one or a couple of machines via syslogd? Unless your network is heavily congested, that could be a good thing to do: if you send your logs to a couple of secure hosts, you still have the chance to read what happened to your machine even if an attacker goes in and destroyes the log files (BTW, you get a little information if he stops syslogd on the attacked host, but a little would be better than nothing...)

Second, instead of transferring a whole log, you could preprocess it using swatch and send just the interesting parts of it; swatch happens to be a Perl program and is a very good tool for log monitoring and filtering.

Ciao!
--bronto

The very nature of Perl to be like natural language--inconsistant and full of dwim and special cases--makes it impossible to know it all without simply memorizing the documentation (which is not complete or totally correct anyway).
--John M. Dlugosz