We want to receive syslog messages from the security gateway itself (not traffic related logs), for example, /var/log/messages from syslog. The issue is that, if you activate the syslog from the security gateway, the syslog messages are not in RFC compatible format, which screws the parsing on the server side.
I've been thinking about using the "send traffic to the Management Server" option and export (or view) the logs from there to the syslog server.
What is the best course of action to achieve logging to an external server? What is usually used on these situations?