This article explains an issue where the SRX will not forward LSYS specific security logs to an external syslog server.

You will not see LSYS specific security logs in your external syslog server.

When you enable security logging in the policies within a specific user LSYS, you need to add the complete syslog configuration in each LSYS and also need to add a valid route for the syslog server in each LSYS. This server needs to be reachable via all the logical systems. This can be configured as:

logical-systems {
    Test {
        security {
            log {
                mode stream;
                format sd-syslog;
                source-address 192.168.1.1;
                stream trafficlogs {
                    format sd-syslog;
                    category all;
                    host {
                        192.168.2.2;
                        routing-instance test-vr;
                    }
                }
            }
        }
   }

logical-systems {
    Test {
        routing-instances {
            Test-vr {  
                routing-options {
                   static {
                         route 192.168.2.2/32 next-hop 192.168.1.2; 
            }
        }
    }
}