We have two VMs running ContentConnect and my server folks want syslogs to Splunk. I'm just starting to look into to this so just throwing this out there to see if anyone has installed a forwarder on CSS or somehow sent logs to Splunk.
Thanks
In my experience, real time syslogging on anything that processes real time media is asking for performance issues.
My org has Splunk and I do not syslog to it