On Linux, the syslog server configurations are automatically synced with Identity Server and Access Gateway when you select syslog for auditing.
On Windows, you need to manually install the preferred syslog service and configure it to communicate to the local TCP port 1290. To configure the syslog agent to communicate with the remote syslog server, you need to manually configure the installed syslog agent on each device.
To configure syslog, see Setting Up Logging Server and Console Events. For more information, see Syslog Configuration White Paper (https://www.netiq.com/documentation/access-manager-44/resources/NAM_Auditing_with_Syslog.pdf).