In 4.3.1/5.3.1, MARS can act as a relay for the syslog messages received from reporting devices to a single collector.

A reporting device is a source host that generates a syslog message and sends that message to a Local Controller.

A relay is a Local Controller that receives a syslog message from a reporting device and forwards it to a collector.

A collector is a host that receives a syslog message, but the collector does not relay it to another host.