hi sja,.. thanks for the suggestions
1. we have two pairs of kiwi setup behind a load balancer but it is more for failover instead of actual balancing...
2. linux.. yes.. we currently have this single source going to a linux based syslog and the stats show a steady 1000 messages per second and spike to 1700 messages per second.... our organisation purchased kiwi syslog so the direction was to use kiwi for all syslog but I'll have to get this source as an exception.
3. as mentioned.. can't really tweak this source much more