Now that we have figured out how to receive syslogs remotely (tunneling through NAT with l2tp).. I am noticing that only a small portion of log data is being reported.
I have been using BSD so that I can prefix logs into SUBDIR/name.info (etc) otherwise all the logs from 30 devices dump into the same spot.
I cannot use the sorting features of rsyslog because the IP's from the routers are natted and change all day long.

What I do not understand is whether the Facility 3 (daemon) is the issue with not getting all of the log data or if it has to do with the logging rules that we have setup.
I get nothing about reboots, watchdog, or lte1 going down/up, or any of the other log data that shows up in memory under the same categories.
I have tried setting the facility lower/higher (kern, user, etc) and setting the severity lower/higher to no avail.
Any help would be greatly appreciated.

Also. I don't understand why,
If I add a topic "info" to action "memory"
I can see anything that contains the topic "info" whether it be system, dhcp, etc.
But if I add a topic "info" to action "remote"
I don't see half of it.

Do I have to go through and add "info, system", "info, error" etc??

And then finally. Is it even possible to get remote logs for a device going offline? I do mean after it comes back up. It can't can it?