Alarm journal event data 'sys:'

Forgive me if this is outlined somehwere but I am having a hard time getting specific results when searching.

Diagnosing an issue with alarm journal syncing between backend gateways. Our front end alarm marquee will populate with the correct alarms but the journal is not logging the events.

Can someone explain the source data from remote gateways. Some seem to lead with Prov: and but others with sys:

Additionally - If alarming is set up on tags at the backend gateway - then derived tags are created at the front end and alarming is configured on both - does redundency that should be eliminated?