I have approximately 32 SLES 11 SP3 servers running on System z (mainframe) and am trying to figure out why log files are not being treated the same on all of the servers. I am trying to determine why a few servers are not processing the log files the same as the majority of the servers are.

Syslog-ng is working properly on most of the servers in that the various messages are being logged in /var/log into files such as firewall, mail, mail.info, mail.warn, messages, etc. Logrotate is being invoked and is creating .bz2 files.

.
.
.
-rw-r----- 1 root root 1678154 Feb 4 06:49 firewall
-rw-r----- 1 root root 162674 Nov 29 00:00 firewall-20131129.bz2
-rw-r----- 1 root root 173509 Dec 6 00:00 firewall-20131206.bz2
-rw-r----- 1 root root 185288 Dec 13 00:00 firewall-20131213.bz2
-rw-r----- 1 root root 184341 Dec 20 00:00 firewall-20131220.bz2
-rw-r----- 1 root root 178501 Dec 28 00:00 firewall-20131228.bz2
-rw-r----- 1 root root 164442 Jan 4 00:00 firewall-20140104.bz2
-rw-r----- 1 root root 193302 Jan 11 00:00 firewall-20140111.bz2
-rw-r----- 1 root root 193204 Jan 18 00:00 firewall-20140118.bz2
-rw-r----- 1 root root 186124 Jan 25 00:00 firewall-20140125.bz2
-rw-r----- 1 root root 190887 Feb 1 00:00 firewall-20140201.bz2
.
.
.
-rw-r----- 1 root root 2878985 Feb 4 06:50 messages
-rw-r----- 1 root root 251563 Apr 12 2013 messages-20130412.bz2
-rw-r----- 1 root root 190486 May 18 2013 messages-20130518.bz2
-rw-r----- 1 root root 191482 Jun 23 2013 messages-20130623.bz2
-rw-r----- 1 root root 186454 Jul 28 2013 messages-20130728.bz2
-rw-r----- 1 root root 191182 Sep 1 00:00 messages-20130901.bz2
-rw-r----- 1 root root 192293 Oct 7 00:00 messages-20131007.bz2
-rw-r----- 1 root root 198968 Nov 11 00:00 messages-20131111.bz2
-rw-r----- 1 root root 179388 Dec 5 00:00 messages-20131205.bz2
-rw-r----- 1 root root 183243 Dec 28 00:00 messages-20131228.bz2
-rw-r----- 1 root root 182494 Jan 20 00:00 messages-20140120.bz2
.
.
.

The servers I'm seeing 'the problem' on are not logging into /var/log files firewall, mail, mail.info, mail.warn, messages, etc. The files firewall, mail, mail.info, mail.warn, messages, etc. have a size of zero bytes. The messages are being logged into other files though.

.
.
.
-rw-r----- 1 root root 0 Feb 2 00:00 firewall
-rw-r----- 1 root root 5367051 Jan 26 07:44 firewall-20140112
-rw-r----- 1 root root 0 Jan 12 00:00 firewall-20140119
-rw-r----- 1 root root 0 Jan 19 00:00 firewall-20140126
-rw-r----- 1 root root 2796508 Feb 4 06:57 firewall-20140202
.
.
.
-rw-r----- 1 root root 0 Feb 2 00:00 messages
-rw-r----- 1 root root 2828304 Jan 26 07:52 messages-20140112
-rw-r----- 1 root root 0 Jan 12 00:00 messages-20140119
-rw-r----- 1 root root 0 Jan 19 00:00 messages-20140126
-rw-r----- 1 root root 1473506 Feb 4 06:55 messages-20140202
.
.
.

In the previous, last, file list, the firewall messages are being logged into firewall-20140202 and the system messages are being logged into messages-20140202.

I have compared the /etc/syslog-ng/syslog-ng.conf files and don't see anything that could be causing the difference. The logging problem is not resolved by a reboot. The only way that I can get the messages logged into /var/log/firewall and /var/log/messages is to issue command 'syslog-ng restart'. A reboot will cause the problem to come back.

What other files can I check to determine the cause of this?