One could also have a seperate "oh shit!" log file that only gets written to by syslog-ng internals and not through standard mechanisms. A non-blocking write(2) could be used to ensure that these messages didn't impeed on other logging (much).

I prefer this option also (despite its lack of elegance :), it's the most system independant and allows the sysad to stick a log watcher on it or whatever. Also because it avoids the in-band race issue.