The device's built-in Syslog daemon collects local events of the specified types, and forwards the events locally to the agent. The agent streams the events to your Log Analytics workspace. After successful configuration, the data appears in the Log Analytics Syslog table.