Most of the fields on the CEF format message can be sent by event forwarder, but not the Terminal field.
PAMSC 14.1 cp05
When the connection is done via ssh, and seos is restarted after the connection, the terminal information is lost
This will be fixed in PAMSC 14.1 cp06
or ask support for a hotfix to install over cp05