When using syslog through tcp (instead of udp) from imperva, many packages are lost since they do not arrive in order. So at destination everything is screwed up since they can not be reassembled