From 12.4.2 onwards, you can:
View and change the log levels for all services on any number of appliances in the cluster.
Send syslog data to the same SIEM platform.
To configure the logging settings for managed appliances
Ensure, In CMS under Central Management > Authentication Servers, Appliances share the same authentication servers is selected.
In the AMC, navigate to Monitoring > Logging.
Select the Managed Appliance tab.
Click on All appliances to adjust logging levels for all appliances or click on specific appliance.
Select Enable plaintext logging for Web proxy
or
Select Flush log messages immediately
or
Select Collect system health information
Click OK.