Maybe I'm reading your post in the wrong way, but you don't need anything more than reading from STDIN.

What I don't know is how to empty <STDIN> after that

Each read removes the data you read from STDIN, if you want to empty it just keep reading

and how long to wait before reading it again

You don't have to explicitly wait, if there's data your read will succeed, if there isn't your read will block gracefully until they arrive

I don't want to read <STDIN> when syslog is in the middle of sending the message

This is not a problem at all (I hope). Note that the idiom:

   $line = <STDIN>
[download]

reads until end-of-file (which shouldn't happen in your case, unless you have major problems) or until it hits the end of the record separator $/, which is normally set to a newline to give you one line at a time.

So, if you analyse your logs on a line-oriented fashion, you don't have to do anything. OTOH, if you have to correlate different lines, you have to implement some logic to understand when and where you want to break your input into parts. Anyway, this doesn't seem a problem related to STDIN IMHO.

Hope this helps to fade away your fears.