You have two sites and one Symantec Endpoint Protection Manager (SEPM) on each site. A client connected SEPM-A as primary server in management server lists (MSL) and detected a risk on it. After that, SEPM-A was down without uploading risk log from that client. The client connected to another SEPM-B as secondary server. But the risk log was not uploaded to SEPM-B.

Fast Pathing function upload of critical logs was trying to send logs to only the first server in the MSL. In this scenario, the first SEPM is down so the log would never be uploaded.

This is fixed in SEP 14 RU1 MP2 and newer client.