I want to input my logs into a database in real time - why can't I do it?
You can, as long as you use a recent enough syslog-ng (version 2.1 or later) with database support enabled. Syslog-ng uses libdbi to access databases, so you can use databases which are supported by libdbi on your system. If database support is not available in your syslog-ng, you have different options. You can download a precompiled binary from Balabit ( http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/downloads ), if it is available for your system. Or you can simply take advantage of syslog-ng's ability to pipe to a program.