1. A method for collecting logs from multiple nodes in a cluster of intermediary devices, the method comprising: receiving, by a logger of a first device in communication via a network with a cluster coordinator of a cluster of intermediary devices intermediary to a plurality of clients and a plurality of servers, information from the cluster coordinator identifying a first topology for the cluster, the first topology comprising identification of each active intermediary device of the cluster and a network address for each active intermediary device of the cluster; establishing, by the logger of the first device responsive to the first topology received from the cluster coordinator, a communication channel via a transport layer connection between the first device and the network address for each active intermediary device identified in the first topology; collecting, by the logger of the first device, via each communication channel, log entries from each active intermediary device identified in the topology, each log entry comprising information on network traffic traversing the respective intermediary device; and merging, by the logger of the first device, the collected log entries into a unified cluster log comprising information on network traffic between the plurality of clients and the plurality of servers traversing each of the intermediary devices in the cluster ordered according to an ordering scheme.