The only log storing that I am aware of, is when FW to Panorama link is lost... then the FW will buffers its logs, to send to Panorama.
This functionality is not available with Syslog, and I do not believe there is a document to explain it.
With syslog, the FW send the messages outbound.... if there is no connectivity, the FW is not aware of this, and continues to forward to a location of the network that does not exist. It is basic OSI model troubleshooting. If L1 is down, nothing will egress.
... View more