The events are logged to syslog via special logger configuration that sends the log messages to the rsyslog daemon over tcp protocol (locally). The messages from the two logging managers are sent with different tags (NEM_SYSTEM_EVENT and NEM_SECURITY_EVENT) and are dispatched to different files (/var/log/nem/log/nem-system-event.log and /var/log/nem/log/nem-security-event.log respectively) based on the tags.