Authentication logging goes through the database, which facilitates centralized logging in cluster environments, however makes real-time syslog events somewhat challenging and requires fundamental changes in the way how logging is implemented. The log viewer in the product is real-time.
Please ask your partner, or if you are a partner to go to the idea portal in the Partner Center to add your specific requirements to the idea with the name: "ClearPass sent all events to external syslog immediately".