For scalability use SenSage (<a href="http://www.sensage.com/customers" rel="nofollow">http://www.sensage.com/customers</a>).  Their some of their customers gather 200GB-500GB of log data daily and at least one customer has a petabyte of historical log data under management.  Query performance over long time ranges is important ... when you discover a new exploit in use, how can you tell how long it's been employed unless you can look at history?