If we have two syslog streams to two syslog servers from one NSS VM, is the Zscaler cloud sending two copies of the data? Where are these differently-formatted syslog messages being created and prepared?
The Zscaler cloud sends highly compressed/tokenized/encrypted data to your NSS VM. The cloud sends a single consolidated stream to your on-prem VM that contains everything the VM needs to format multiple streams for the destinations you have configured. In other words, we’re not unnecessarily consuming external bandwidth in order to supply what amounts to duplicated (if differently-formatted) information to your two syslog servers.