I'll read up on it, and probably go with supporting both LOAD DATA and HandlerSocket (after thinking a bit more about the INSERT variations, the few things I didn't like about LOAD DATA aren't that severe that would make it worth exploring the INSERT options).
Good points. LOAD DATA really is the holy grail of INSERT for both speed and universality. As I wrote earlier, just writing to /dev/shm means you don't need tmpfs on Linux. You might want to look at the source code for the mysqlimport binary to see how they implement the various low-level functions for LOAD DATA. Surely there's a way to bypass the ridiculousness of a buffer file if you can load straight from in-program memory in syslog-ng. When looking at an implementation, don't forget the functionality that comes with "CONCURRENT" so that it doesn't need to lock the table or block. The manual says there is a performance hit for doing this, but I can assure you it is unnoticeable.