Initally we were using standard syslog daemon for local and remote logging. Over time we had some network trouble and were forced to re-transmit loglines to central logging server. Since we store all logs for 30 days local, this was not a problem. This local log was used to compare lines on the CLS with the local copies. If line count does not match, you have a problem.
PS: oh yes, rsyslog had trouble with remote / local loglines not being identical..