When there are multiple syslog servers added to SWG > Administration > Configuration > Syslog, only the first syslog server in the list will receive any alert notification.
Symantec Web Gateway (SWG) does not attempt to send any alert to other syslog servers in the list.
SWG 5.2.1, 5.2.2
SWG is not quoting the string containing the syslog address(s) individually but as a entire string.
Symantec is aware of the issue and is investigating a possible solution.