Syslog can drop the logs under heavy load. Look for these logs to confirm:
xxx messages lost due to rate-limiting
Add to rsyslog.conf to disable rate limiting (assuming your using imjournal):
$imjournalRatelimitInterval 0
$imjournalRatelimitBurst 0
Eric
