Sorry for the delay in responding - I was collecting some information from the development team in this space.  You will get ALL user and audit logs delivered to the remote syslog server regardless of which facility you choose. The facility is simply sent along with the syslog data for filtering purposes on the remote syslog server. For example, on Linux the remote syslog server will put logs into /var/log/mail instead of /var/log/messages. I'm not sure that's what you would necessarily want but you can get that if you need.  I would suggest to simply use User-Level Messages as the facility.
i have the "Remote Logging" setup to send to our sysylog server. On the VNXe 3100 under "Advanced" you have a "Facility" option with many choices. Which of those choices gives you the most/best logging?  I would like to have everything but i dont see an option for all...can you get everything sent to a syslog server?  Also was wondering what other users have picked here and if the data they are collecting is good or just noise.   Thanks
Remote Logging (SysLog)