Todd Glassey @ Att.Net wrote:

If you are looking for a legal answer then under SOX and other global legislation there are formal retension periods of as much as seven years. While that wasnt quite what you asked, any company or entity would need some kind of log management process under ISO17799/ITIL/ and COBIT standards that assures that *no* information is lost in the logging process - that means what it means - if your logging systems are separate and not auditable - then you may have to provide log management for the whole period.

That means simply that the remote server needs to hold onto the logs for whatever the periodicity of your log maintanence process/program is.

Thanks for that, they are being stored locally on the remote server too. It was a purely technical question about passing messages between syslog-ng servers. Jim Mozley