Is it necessary to install all zimbra packages

As no one posted until now, I will mention zmbak script from: http://www.osoffice.de/downloads/viewcategory-7.html.
I'm currently testing it.
After reading it, I can say it's wort a try. I guess you can adapt this to your needs.

HTH

I've found that rsyslog, when forwarding logs via TCP to a remote host, will sometimes get hung up when it can't forward to the remote host. Even when the remote host comes back up, rsyslog remains hung and as a result slows down everything else on the system that tries to log. Restarting rsyslog does the trick when it happens, but restarting it regularly via a cron job never seemed to work for me. The best solution I found is to not have the remote host go down so much. :)

However, there are tweaks that can be made to rsyslog so that it queues rather than locking up. You might still experience the issue, and in that case no logs will be forwarded until rsyslog is restarted, but it will not affect the system as a whole.

Comment out your current forwarding rule, and drop this at the end of your rsyslog.conf:

$WorkDirectory /var/spool/rsyslog # where to place spool files
$MainMsgQueueFileName mainqueue # unique name prefix for spool files
$MainMsgQueueMaxDiskSpace 2g   # 1gb space limit (use as much as possible)
$MainMsgQueueSaveOnShutdown on # save messages to disk on shutdown
$MainMsgQueueType LinkedList   # run asynchronously
$MainMsgResumeRetryCount -1    # infinite retries if host is down
*.* @@1.2.3.4:514 # replace this with your own forwarding rule

You will need to make sure /var/spool/rsyslog exists because it will not create it otherwise.