Is it possible to get a dump of all the syslog entries that the server has collected? I'm assuming it's stored somewhere... For example, if we have a gateway at a remote location receiving syslogs from a few devices that we're monitoring, are all those syslog entries relayed back to the central server, and are they all stored based on the log retention setting? Or are the only syslogs that are kept the ones that trip a monitor?
If ALL the syslog entries are relayed back to the central server (for parsing/alerting), could we allow the server to forward those received syslogs out to a seperate syslog server (like Splunk for example) for long-term archival and reporting purposes? It would be important to preserve the original source IP so the syslog server can parse them correctly...