Interesting issue, but at the same time... no offense (!) but from my perspective all you need is a good look at syslogd as well as syslog.conf.
I mean, for starters, you previously mentioned -ss but all that does is make things "worse" because it only locks things down even further.
But...