We have rsyslog installed with the base package on all servers. That also trigger the installation of misc::remote-syslog which use rsyslog to send logs to a central box.
When setting up the central box, one has to use the syslog::server class which try to install syslog-ng instead of rsyslog but still has misc::remote-syslog.
The end result is that each time puppet run on the host, whatever syslog system runs at that time is replaced by a the other one.
How to reproduce:
Log on deployment-syslog
Run twice: puppetd -tv
Version: unspecified
Severity: normal