Best I can find is in the SSIM forum, hope that helps. https://www-secure.symantec.com/connect/forums/help-how-can-i-collector-sep11-events

Hi,

To configure external logging, you need to go to Admin-> Servers-> Local Site -> Configure External Logging

And I think the SSIM is able to accept the logs in syslog format. So if you provide the address of SSIM with the relevent information, it should be able to forward the logs.

Best,
Aniket

Hi Aniket , do you have any Idea which facility level should be used .

Using Syslog forwarding will work but it is not the best way, as the problem with any syslog (TCP/UDP) is that is target is down messages can be lost. (also suing syslog the mapping won't be good as it won't be correlating events with Deepsight GIN data.

SSIM has special Symantec EndPoint Collector 4.3. This collector goes directly in the DB to collect information (it support SQL or Sybase)

If you are using SSIM 4.6 or 4.7, this collector is alredy pre-installed onboard.