In best practive send logs to syslog to most of the information is catoure and we can make own decision to discard in syslog what logs required, rest of logs removed from syslog server, since there is no need un nessary logs in the syslog server.
In general i configure severity level 7 so most of the information sent to syslog server ( even though we mentioned 7 we do not debug all time so 0-6 covered already)
make sense ?