Local0-3 is not used by Linux.
VOS only uses Local 4,5,6,7.
7 is for messages - like daemon start/stop etc
6 is for alarms (general)
5 is for local alarms (not sent out to other destinations)
4 is for monit logs (Monit is a Unix daemon, not a versa product)
Snippet of the Reference config:
For example, if you only forward Local6, we will only see Versa-Alarms on the remote syslog server.
Below is taken from this link from Google: https://success.trendmicro.com/dcx/s/solution/TP000086250?language=en_US