There are two different sets of labs, and two presentation.

• One covering syslog-ng, followed by a lab on syslog-ng and tenshi
• One covering rsyslog, followed by a lab on rsyslog and swatch

Technically we could combine these differently (syslog-ng + swatch, as was the case originally, for example).

There's an argument for sticking to rsyslog, as it's the default syslog daemon in 14.04/16.04. There are also some issues with rsyslog, in particular it being very picky about spaces vs tabs, which tend to cause issues during labs.