syslog-ng config

Common section:

@version: 3.2

options {
    long_hostnames(off);
    flush_lines(0);
    use_dns(no);
    use_fqdn(no);
    owner("root");
    group("adm");
    perm(0640);
    stats_freq(0);
    bad_hostname("^gconfd$");
};

Write system log and kernel message to file:

# Record syslog to file
source recorder {
    file("/proc/kmsg");
    unix-dgram("/dev/log");
}
destination recorder {
    file("/var/log/syslog"
        owner(syslog)
        group(adm)
        perm(0644)
        dir_perm(0755)
        create_dirs(yes));
}
log {
    source(recorder);
    destination(recorder);
};

Send local log to remote:

# Send local syslog
source sender {
    file("/var/log/syslog");
};
destination sender {
    tcp(log_1.server port(514));
    tcp(log_2.server port(514));
};
log {
    source(sender);
    destination(sender);
};

Receive log from remote:

# Receive remote syslog
source receiver {
    udp(ip(0.0.0.0) port(514));
    tcp(ip(0.0.0.0) port(514));
};
destination receiver {
    file("/var/log/remote/$YEAR.$MONTH.$DAY/all"
        owner(root)
        group(adm)
        perm(0644)
        dir_perm(0755)
        create_dirs(yes));
    file("/var/log/remote/$YEAR.$MONTH.$DAY/$HOST"
        owner(root)
        group(adm)
        perm(0644)
        dir_perm(0755)
        create_dirs(yes));
};
log {
    source(receiver);
    destination(receiver);
};

Be sure just use "/dev/log" at source section onece.

Reference: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.2-guides/syslog-ng-ose-v3.2-guide-admin-en.html/bk01-toc.html