Hmm - sounds like there are no syslog events arriving. If you change directory to $ZENHOME/log and do a ls -l on the file, when was it last updated? Might it have been when you changed the logorig parameter? For example:
[zenoss@zen42 log]$ cd /opt/zenoss/log/
[zenoss@zen42 log]$ ls -l origsyslog.log
-rwxrwxr-x 1 zenoss zenoss 28613171 Apr 16 09:00 origsyslog.log
[zenoss@zen42 log]$ less origsyslog.log
[zenoss@zen42 log]$
The date is the last time the file was updated. the big number (28613171) is the size (which should obviously increase whenever a syslog message is received). less is a unix command to display the contents of a file (space gets the next page, carriage-return gets the next line, if you know some vi editor commands then they work too).
If this file is virtually emptry and not updating when you believe it should be recieving events, then I would certainly focus attention on the syslog systems that are supposed to be forwarding events to Zenoss and at any fiewall that might be in between.
One test I usually start with is to configure the Zenoss server so that his own syslog events are forwarded to Zenoss (have a look at the Event Management paper for an example). If you can get those flowing then you know that zensyslog is capable of reading and interpreting events. and you can focus your attention on the delivery mechanism.
Cheers,
Jane