How to change the Endpoint Protection Manager log file delimiters for external logging

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) is configured to send logs to an external syslog server and you would like to change the delimiter that separates the fields in the logs.  The fields are comma delimited by default.

Environment

SEP 14.x

Resolution

The delimiter can be changed using the following steps:

1. Open the conf.properties file in a text editor. This file is located under C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\etc by default.
2. Add/Modify the following line with the desired delimiter.  The delimiter will be the value after "=".  
   • scm.extlog.deli=
     • Note:  The default value is "scm.extlog.deli=,"
3. Save the changes to the file.
4. Restart the Symantec Endpoint Protection Manager service.