What log type would indicate whether a VPN is going up or down?

The Event log, often found as system events, captures system-level occurrences such as VPN tunnel establishment or termination, providing real-time status updates on the operational state of the VPN.

The Security log primarily records events related to security policies, authentication, and access, not the operational status of a VPN tunnel itself.

A Forward log typically refers to logs for forwarded traffic, detailing network traffic that passes through a device, not system-level events.

Syslog is a protocol for sending log messages, not a specific type of log content; system events would be sent via Syslog, but the content type is still event-based.