You enabled External Logging in the Symantec Endpoint Protection Manager (SEPM) to send Symantec Endpoint Protection (SEP) client logs to a Syslog Server. When looking at the SEP client logs from the Syslog Server, you notice that the client event times are not included in the syslog message and only see the times when the client logs were sent to the Syslog Server.

The SEP client event times were not included in the syslog message for the client logs going to the Syslog Server.

This issue is fixed in Symantec Endpoint Protection Manager 14.  For information on how to obtain the latest build of Symantec Endpoint Protection, read
TECH 103088: Download the latest version of Symantec Endpoint Protection