Log source is stuck on the "initializing".
By default, web application information is included in the Reporter database. If this feature is not manually disabled and Reporter is unable to download the current web application attributes from Symantec, log data will not be consumed and log sources will remain in the "Initializing" state until either the application attributes are downloaded or this feature is disabled.
To disable the download of Web Application Attributes on the Reporter appliance, to resolve the "Initializing" stuck state, please implement the guidance in the snippet below.
Reporter Log Processing
In a new installation, Reporter must obtain web application attributes from the Global Intelligence Network (GIN) over an internet connection before it can begin processing log data. At every startup, you can see these messages in the system event log: message a will show that Reporter is verifying that it has this additional data. Message b may periodically occur if Reporter is unable to obtain the data. Once the web application data is obtained, it is stored locally for a period of time until a refresh is required, as determined by the web application. Any time Reporter starts up, message c must show before log processing can resume. If message b is not soon followed by message c, check for connectivity between Reporter and the internet.
a. Initializing Web Application data - Log processing disabled
b. Web Application data failed data initialization - Log processing disabled
c. Web Application data initialized successfully - Log processing enabled
Reporter dynamically obtains external data while processing log data. Reporter will not process log data until the web application data is initialized successfully.
For the implementation guidance, please, see the highlighted portions in the snippets below