I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends over time. Its supposed to provide intrusion detection as well as health monitoring.
After evaluating many Syslog Windows agents, I have not yet found a single freeware agent that supports TCP over HTTPS (while the Synology server does support it). They're almost all hardcoded to UDP port 514 (well, I can change the port on some, but I don't consider that helpful).
Since I'm planning to send converted windows eventlog messages over, I don't feel comfortable sending them unencrypted (they can contain full stacktraces and stuff like that).
I have looked into ways to limit the risk, and the only thing I can find is setting up the firewall to limit the sending of Syslog messages to my IP address. For SNMP the firewall can be limited to only accept requests from my client. An alternative is a commercial product with some hacks (which I'm not feeling really comfertable with).
The strange thing is that it seems like UDP 514 is the standard and even recommended looking at the answers in this thread, just like SNMP.
Am I too careful? It seems like the rest of the world has no problem with UDP? Do hosting providers of VPS servers prevent sniffing software on the internal (virtual) network? Or is it just safe to use UDP after all?