SyslogAppender of 1.2.14 only prefix the PRI part, but not the HEADER part of a syslog message according RFC 3164. The problem is aready fixed at the trunc (1.3). Please backport this fix to the 1.2 branch.
I don't think we can change the default behavior as it has been out there so long that people may have designed LayoutPatterns to provide the missing timestamp and hostname and could be disrupted if we changed the behavior. However, it does seem like we should add a header property (that is what the combination of timestamp and host name are called in the RFC) with a default value of false that when enabled resulted in the appender providing the timestamp and host name. There is another syslog appender issue involving headers/footers and will have to review to make sure that both can be addressed without conflicting over the "header" name.
Committed rev 510660 to v 1.2 branch. Appreciate any feedback. Reopen if unsatisfactory.