We haven't had many syslogd(8) vulnerabilities lately, but one
less daemon running as root seems like a Good Thing. I do not
see any drawbacks from a security point of view. The log files
would have to be owned, or otherwise writeable, by this other
user, but so what. Obviously, I may be missing something.
One consideration is that if syslogd is not running as root,
it will no longer be able to write to a filesystem which is
On systems where non-root users can write to the filesystem
containing /var/log (and are not limited by quotas) this would
allow non-root users to disable logging, which would probably
be a Bad Thing.