1. A method for collecting logs from multiple nodes in a cluster of intermediary devices, the method comprising: determining, by a first device in communication via a network with a cluster coordinator of a cluster of intermediary devices, a first topology for the cluster, the first topology identifying each active intermediary device of the cluster; establishing, by the first device, a communication channel with each active intermediary device identified in the first topology; collecting, by the first device, via each communication channel, log entries from each active intermediary device identified in the topology, each log entry comprising information on network traffic traversing the respective intermediary device; and merging, by the first device, the collected log entries into a unified cluster log comprising information on network traffic traversing the cluster.