I found something wrong. Please review this.
KB-000035820 must describe how to send syslog over vpn from Branch office to Head office.
But this actually deccribes a guide to opposite.
"The configuration above sends Syslog traffic from Head Office to Branch Office."
And I guess setting should be done within Branch office firewall, not Head office firewall.
Thanks