In case when logging to syslog through TCP protocol is configured and syslog port becomes unreachable then after syslog restart some messages can be thrown away. 

It seems syslog handler needs to another two logs for correct closing original TCP connection. In case when syslog is restarted and:
 
- no message is logged during syslog is unreachable then the first two messages will not be logged to syslog after syslog is running again

- one message is attempted to be logged during syslog is unreachable then the first message will not be logged to syslog after syslog is running again

- two and more messages are attempted to be logged during syslog is unreachable then everything is logged correctly after syslog is running again

How to reproduce:
1) Configure EAP to log some category to syslog through TCP:
            <custom-handler name="SYSLOG_TCP_HANDLER" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
                <encoding value="ISO-8859-1"/>
                <formatter>
                    <pattern-formatter pattern="%-5p [%c] (%t) %s%E%n"/>
                </formatter>
                <properties>
                    <property name="appName" value="JBossEAP"/>
                    <property name="facility" value="LOCAL_USE_5"/>
                    <property name="serverHostname" value="127.0.0.1"/>
                    <property name="hostname" value="-"/>
                    <property name="port" value="10514"/>
                    <property name="syslogType" value="RFC5424"/>
                    <property name="protocol" value="TCP"/>
                    <property name="messageDelimiter" value="-"/>
                    <property name="useMessageDelimiter" value="true"/>
                </properties>
            </custom-handler>
...
            <logger category="org.jboss.as.test.integration.logging.operations">
                <level name="INFO"/>
                <handlers>
                    <handler name="SYSLOG_TCP_HANDLER"/>
                </handlers>
            </logger>
2) Start application server and syslog server.
3) Deploy logging servlet (see attachements) which makes one log when is accessed.
4) Access http://127.0.0.1:8080/logging-deployment/logger -> message is logged to syslog
5) Restart Syslog server
6) Access http://127.0.0.1:8080/logging-deployment/logger three times -> first and second message are thrown away, only third message is logged
7) Stop Syslog server
8) Access http://127.0.0.1:8080/logging-deployment/logger twice (messages are not logged to syslog since it is down)
9) Start Syslog server
10) Access http://127.0.0.1:8080/logging-deployment/logger -> message is logged to syslog