Tomato's standard syslog (/var/log/messages) is on a temporary filesystem, which disappears when the router reboots.
Tomato can send log messages to another computer, to a log server. Two such programs for Windows are: Sysrose Syslog Desktop and Syslog Watcher 2.
Tomato can also, with the help of an autorun script, put the log file on a USB disk or cifs share. Just like a real Linux system, the logfiles can be rotated by size, by day/week/month, and excess old versions will be deleted.
Just download and copy the below script into the root directory of the device (USB disk or cifs share), and make it executable (chmod +x '25-log-to-disk&.autorun'). Note that the "&" is (a required) part of the filename, so you'll have to enclose it in single quotes, or put a backslash in front of the "&".
The logs go into the "log" directory of that disk, so you have to create that directory manually: "mkdir /mnt/whatever/log" or "mkdir /cifs1/log". If that directory does not exist, the logs go into a directory which is hardcoded in the script (variable DISK).
As supplied, the script is configured for a 5MB logfile size, keeping 9 backups. To change this, edit the file and change the "PARAMS=" line.
As supplied, the log is rotated every day at midnight. To change this, edit the file and change the "cru" line.
The current syslog is always "/var/log/syslog".
The script is a file attached to the tutorial page. Click on the Files button at the bottom of the tutorial page. Be careful when you download it, so that the end-of-lines stay as UNIX eol's and don't get converted to DOS eol's.
The easiest thing to do is download it directly to your router, using the command "wget http://tomatousb.org/local--files/tutorials/25-log-to-disk%26.autorun". Again, watch out for that & in the filename (on a web page sometimes it shows up as "%26").