Jim
Basically they get lost.
Cisco does have support for TCP with syslog but still the problem remains that if the server is down then the messages will simply be lost ie. it cannot be sent until the server comes back up and then a TCP connection is reestablished.
So the issue is not really TCP vs UDP ie. with UDP it is sent but never received because the server is down, with TCP it isn't sent because there is no TCP connection between the router and the server.
I don't know of any method to recycle back through the buffer to resend any messages since the syslog server went down. Even if they could be sent that is supposing that you could get the server up before the buffer filled up and cycled around.
The only thing i can suggest is for critical devices you can have a separate management network (almost OOB) and then have multiple syslog servers in the router config, the one for production and one as a backup. This may not be practical depending on the size of your network, WAN etc,
Bear in mind (from memory) that some syslog servers allow you to create a hierarchy ie. you send all messages to one server and then send a subset to a centralised server. If your main worry was the WAN then in each site you could have a local syslog server for all local devices and then send the most important messages to a central server.
Jon
