External Syslog Servers and Clustered Nodes
When working with clustered nodes, set up logging individually for each clustered node.
Events sent to external syslog servers are sent over the Mgmt port of the node logging the event and not over the cluster’s leader/VIP address.