We send our syslogs to a SQL server. More than that, we send to different tables based on the syslog facility we have assigned to our various gear by groups (Routers, Switches, UPS, etc). Under each rule that separates this traffic is a call to a script that updates a message counter for a customstats assigned to that facility. There is another script that resets the counters at specific intervals. Before clearing the stats for the next interval the counters are written to another SQL table.
I thought it would be neat when I set it up but in reality I don't use it that much up to now.
BobL.