Recently I wanted to build a log collection virtual machine. I settled on a combination of syslog-ng and splunk. Syslog-ng lets you do filtering, message rewriting and routing to multiple destination types. Splunk v4 gives you a nice ability to search the gathered logs. So you can follow my two documents. The roll your own covers the building of the vm. The getting started covers doing the last setup tweak to use and collect certain event types I decided would make a good stating example set.
We use Ubuntu sever 32bit 9.10 with syslog-ng v3 and splunk v4 in this tutorial. I built mine in vmware fusion on my mac. But you should be able to adapt to your own box/virtualization of choice.