<i>TLS transport mapping for Syslog requires that you maintain both client & server certificates for authentication.</i><p>The point of requiring certificates for the client is so your server doesn't get spoofed logs.
This reminds me of another log shipping tool, <a href="http://logio.org/" rel="nofollow">http://logio.org/</a> which I think recently added support for encryption as well.