You can create a second log subscription, so you can have one that stays on the appliance and one that is offloaded. We did that years ago so we'd have logs on the appliance when tech support needed them. I don't remember the details, but the admin guide spells it out pretty well.
++Don
