Hi,

First of all, following Universal Event Collectors are available:

• Universal LogFile Event Collector

  Collects events from products that log to text files.

• Universal Syslog Event Collector

  Collects events from products that log events by using the Syslog protocol.

• Universal Event Collector for Microsoft Windows

  Collects events from Microsoft Windows event logs.

• Universal Event Collector for Microsoft Windows Vista

  Collects events from Microsoft Windows Vista, Windows Server 2008, and Windows 7 event logs.

Decide what type of collector you are going to use.

Below document will help you in configuring the Univesal Event collectors in proper fashion depending on your requirements.

Symantec™ Universal Event Collectors 4.4 for Symantec Security Information Manager 4.7 Implementation Guide:

http://www.symantec.com/docs/DOC2494

Below are some more articles which can help you in your requirements:

SPECIFYING “LOG FILE NAME” PATTERNS FOR LOG FILE SENSORS:

http://www.symantec.com/docs/TECH146007

How “Log File Name” patterns works with Symantec Security Information Manager Event Collector Log File Sensor:

http://www.symantec.com/docs/TECH141570

I think this will help you in clearing all your concepts......