We are using a vSRX cluster, and I would like to know why the event mode for security logs is not recommended. Additionally, how can I retrieve security traffic logs without relying on syslog and without the risk of saturating the vSRX in event mode?

Event mode is simple and good for a quick implementation in a lab or in production with a low amount of traffic logs. However, for networks with high amounts of traffic, this configuration could impact system resources -- CPU usage, memory usage, storage space, file system.

This is because all the login processing is performed by the SRX Routing Engine, hence wasting resources that could be used for other tasks.

At the other hand with stream mode we avoid this situation by making the syslog server the one responsible for these tasks.

This is why is recommendable to use stream syslog mode instead event mode.

This are the only two methods available to process security logs.

https://supportportal.juniper.net/s/article/SRX-Getting-Started-Configure-Traffic-Logging-Security-Policy-Logs-for-SRX-Branch-Devices?language=en_US