To register syslog server into EPO server, please follow the below steps.
1. Select Menu | Configuration | Registered Servers, then click New Server.
2 From the Server type menu on the Description page, select Syslog Server, specify a unique name and any details, then click Next.
3 From the Registered Server Builder page, configure these settings:
a Server name — Use DNS-style domain names (for example, internaldomain.com) and fully qualified domain names or IP addresses for servers. (for example, server1.internaldomain.com or 192.168.75.101) b TCP port number — Type the syslog server TCP port. The default is 6514. c Enable event forwarding — Click to enable event forwarding from Agent Handler to this syslog server. d Test — Click Test Connection to verify the connection to your syslog server.
4 Click Save.
After you register the syslog server, you can set McAfee ePO to send events to your syslog server. This log file includes any syslog server errors that might occur.
Additionally please go through the below article to know Encryption requirements for ePolicy Orchestrator syslog integration.