The mechanism is quite simple. Sources on all nodes in the network form messages about what is happening and send them to Syslog server via IP. Bees, working in the meadows, collecting nectar from each flower, carry remains of pollen on their paws from plants they've been on. This pollen tells about each flower visited by them. In a similar way, the transferred logs contain information about what is happening with the device, and allow the administrator to be aware of it, even without direct access to a specific device.
Thus, if you have computer failure, then analyzing the chain of events recorded in Syslog, you will always be able to figure out where exactly the failure occurred, and what it was caused by.