> This is for a reporting tool for clusters. It collects all the
> relevant information from all cluster members and that includes
> excerpts from log files. People use all kinds of syslog setups so
> the tool needs to figure out which log file is relevant.

It sounds to me like you are trying to work around a poorly configured environment.  You would do much better in the long run to harmonise the logging configuration of your servers so that they are identical, or at least very similar.

Have you considered simply using a central logging server and adding something to the configuration on each of the clients to send the logs which you are interested in to that central server?  That would be the typical way of achieving what you describe.

Regards,

Scott