The SyslogAppender prints the day with a leading zero, so for example for today: Jan 06.

The RFC however specifies that there should not be leading zero, but a space:

dd is the day of the month. If the day of the month is less than 10, then it MUST be represented as a space and then the number. For example, the 7th day of August would be represented as "Aug 7", with two spaces between the "g" and the "7".