The Symantec Endpoint Protection Manager (SEPM) sends logs to an external syslog server that use the text "null" as a delimiter rather than the "," character. This can cause processing of log entries by the syslog server to fail.
This can be caused by a misconfigured conf.properties file that is missing a configuration for an external log delimiter.
This issue can be resolved through the following:
Open the conf.properties file in a text editor. This file is located under C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\etc by default.
Add the following line:
Save the changes to the file.
Restart the Symantec Endpoint Protection Manager service.
Subscribing will provide email updates when this Article is updated. Login is required.