mastranios I think it would be best to have as little running on your primary poller/web server as possible. If you have the resources to run your syslog server on its own server, then I think that would be the best option. However, I suppose it really comes down to your environment (size/elements/modules/etc...), and the resources you have available.
I think NPM/Core actually has the Kiwi Syslog server running, or at least some version of it. But the less traffic you have going to the main server, the better it will run... or at least should...
Thank you,
-Will