We have subdomain running on our devices to control file system security on the processes on the device. The iControl daemon is currently not allowed to read into the /var/log directory. This could be problematic as the log files grow and the download_file() methods chunking doesn't allow for pre-determining the file size at initiation. You basically repeat downloading at the next start point until end of file is reached. So, let's say you have iControl logging turned on, if your chunk size isn't large enough, you could get into an endless loop as each download request would append data to the log file you are trying to download.
Well, enough of the background. If you want to see for yourself the file restrictions, you can look at the /etc/subdomain.d/usr.local.www.iControl.iControlPortal.cgi file on the device. Theoretically you could modify this yourself but I can't recommend that and I don't know what that would do to a support agreement as it's not recommended to change system level files.
As far as I know the only way to download the log files is via a secure copy (scp) call.
-Joe
Nimbostratus