This article explains the functionality and behavior of the root-streaming option in Security Logging.

The root-streaming option allows user logical systems and tenant systems to generate logs using the root system's stream configuration. When enabled in stream mode, all logs from these systems will be sent according to the root system’s configuration.

The root-streaming option only functions in stream mode. If the user logical system operates in event mode, this option has no effect. If the root system is in event mode, root-streaming will attempt to use the streams, but the logs will not be sent out.

Please refer to the following document for more information: root-streaming