Thank you for asking this question on the support community forum. Do you still have further questions on this application? Typically, in issues similar to this with Syslog, you need to issue the source ip command to be sourced from the LAN to force this traffic to be sent over the VPN.
Here is the Syslog guide for reference: Configuring Syslog Logging in AOS
Please, do not hesitate to reply to this post with any additional questions or information. I will be happy to help in any way I can.
I went ahead and flagged the "Correct Answer" on this post to make it more visible and help other members of the community find solutions more easily. If you don't feel like the answer I marked was correct, feel free to come back to this post to unmark it and select another in its place with the applicable buttons. If you have any additional information on this that others may benefit from, please come back to this post to provide an update. If you still need assistance, we would be more than happy to continue working with you on this - just let us know in a reply.