One Identity support highly recommends utilizing the TCP or TLS protocol to greatly reduce the possibility of log loss that can occur when using UDP for the transport.
UDP is a very unreliable protocol for log sending and receiving due to the nature of the protocol itself.
TCP and TLS are more reliable due to the nature of the protocol and is the recommended transport for log sending and receiving.
NOTE: When configuring Syslog network protocols customers should understand that TCP and UDP both have advantages and disadvantages. TCP will be more reliable, however does incur a speed penalty. UDP will be significantly faster due to the way by which it functions, however in certain situations log loss may occur. This is not a product issue but a result of the protocol being used. Please take the time to review each protocol and choose the configuration that bests suits the environment needs. One Identity Professional Services can be consulted via the Account Representative if required to determine what is best.