Answer to question 1: yes.
Answer to question 2: yes. See Syslog questions.
Answer to question 3: IN is the incoming interface. For inbound traffic hitting VyOS for the first time that is not routed elsewhere (meaning: router itself is the destination) you will not see an entry for OUT. Traffic traversing firewall (that is: being routed) you will always see both the IN and OUT fields populated.
1 Like