But you really don't want to do that if you need accurate log collection and aggregation. Having a local log file is essential to coping with backpressure from the log consumers. Consider what might happen if the remote syslog server goes down or is overburdened.