Data-plane logs are generated at the Packet Forwarding Engine (PFE) level and if the security log configured with Stream mode the logs are sent from the PFE to an external syslog server via a revenue port.
After configuring the screen options the SRX don't send any of the screen logs to external syslog server as the category is configured with nat only which means that Network Address Translation (NAT) events only are logged.
security { log { mode stream; format sd-syslog; source-address 1.1.1.1; stream SYSLOG-SERVER { format syslog; category nat; host { 2.2.2.2; port 514; } }
Screen logs not send to external syslog server.
Add category screen under the security log stream server to log the screen events :
set security log stream SYSLOG-SERVER category screen