May 16 20:40:01 sccp crond[422]: USER root pid 14994 cmd /usr/sbin/ntpclient -c 1 -s -h 127.2.0.2 >/dev/null 2>&1

e.g.

 config

[root@ve11a:Active:In Sync] config  tmsh list sys syslog
sys syslog {
    include "
destination remote_server {
  udp(\"172.28.24.1\" port (514));
};
filter f_alllogs_except_ntpclient {
 level (notice...emerg)
 and not match(\"ntpclient\");
};
log {
 source(local);
 filter(f_alllogs_except_ntpclient);
 destination(remote_server);
};"
}

 test

[root@ve11a:Active:In Sync] config  logger -p local0.notice before
[root@ve11a:Active:In Sync] config  logger -p local0.notice "USER root pid 12583 cmd /usr/sbin/ntpclient -c 1 -s -h 127.2.0.2 >/dev/null 2>&1"
[root@ve11a:Active:In Sync] config  logger -p local0.notice after

 remote syslog

[root@centos1 ~] nc -l -u 514
<133>May 18 21:18:16 ve11a root: before
<133>May 18 21:18:23 ve11a root: after