DLP Enforce event syslog uses default port (514), even though a custom port is configured.