system events

Hi, Im not sure if I have it correctly for my subject line. What's the best way to monitor events/logs of a user modifications. Like for example, we've setup a new firewall on a branch office and gave read only access for helpdesks and admins for peron in-charge of some modifications. 

Correct me if I'm wrong, I was thinking of activating FortiCloud to store logs/events there and access it from our main office but due to the company's cost cutting, they don't want this subscription base. I was thinking of setting up  a log server locally and get those events/logs from that server. 

Any other options or better idea in monitoring user's activity or changes?

Thanks Jeff