Hi Steve,
I still have a couple of questions:
1. If delivery of an event is not possible, should vitess drop the message in favoring execution, or should it never give up?
2. Does your audit log need to report SELECT statements?
For #1: If you need delivery guarantee, the stats logger may not be appropriate as it stands now. It was built as a best effort system. It tries to send, but if delivery fails, it just drops the message. In particular, if the syslog write can't keep up with the QPS, messages will be dropped.
If you need delivery guarantee, but don't need to report SELECT statements, you may want to consider the update stream, which reports from the binlogs. The update stream gives you delivery guarantee, but it's at the MySQL level and only serves raw DMLs.
If none of the above meets your needs, we'll need to build a different system. If all you need is something as simple as writing to syslog, then it would be fairly trivial since the rest of the pieces are already present.