Centos – what is the CentOS equivalent of /var/log/syslog (on Ubuntu)

From the output you've given it looks like the python script is not sending all the pieces of the syslog message that rsyslog is expecting. It appears as if the "{FILTER}" part is where the host and app name should be. You can pretty easily prove this by running rsyslogd with the -d flag then sending the message from python and then from logger. You'll see the raw message as it comes from the socket that way and I bet you'll see that logger is sending more fields in front of the "{FILTER}" part.

/var/log/secure is written to by syslogd (or rsyslogd, depending on the OS version) -- this is controlled by /etc/syslog.conf (or /etc/rsyslog.conf). As shipped, the log class "authpriv.*" is set to log to this file. If you don't wan't logging, your can comment out this selector from the .conf file.

Also, check the logrotate configuration (/etc/logrotate.conf, /etc/logrotated.d/) for the rotation script for syslog. This will typically re-create the file (although the file won't be growing if you comment it out of /etc/rsyslog.conf).