This could be accomplisted with something as simple as:

source s_tail  {

file("/path/to/log.file1" follow_freq(1) flags(no-parse));

file("/path/to/log.file2" follow_freq(1) flags(no-parse));

file("/path/to/log.file3" follow_freq(1) flags(no-parse));

};

log { source(s_tail); destination(loghost); };

destination loghost  {tcp("centrallogger.yourdomain.com");};

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Tony MacDoodle
Sent: Thursday, March 31, 2011 6:11 AM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng] how to push sulogs/utmpx/wtmpx to central logserver

Hello All,

I would like to push only the following log files to a central syslog-ng server. All clients are Solaris 10 and the syslog-ng server is also Solaris 10. IS it possible to push only this information?

wtmpx
utmpx
sulog


Thanks