I have a strange occurnce in the use / config of SEPM, I (sec team) along with systeam are working to send SEPM logs to centralized syslog sever.

I have read the admin/ config guide and it says to enable this option (external syslog) through 'configure external logging properties" tasks in localsite tree.

What suprising over here, that i cannot find this task, My organization is using SEPM version 12, I want to know is there any way that task got disabled by admin /etc. Or is it something that cannot be customizable? Kindly help me in this issue. Thanks.

hello,

are you using SBE version ?

If yes this option not available in SBE version

I will have to confirm this from my sys team guys. So is there an alternative for SBE? MORE like a workaround

SBE edition only limited feature available.

Symantec Endpoint Protection Manager (SEPM) database transaction log (sem5.log) consumes excessive hard drive space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

Feature comparison between SEP 12.1 SBE and EE

http://www.symantec.com/connect/articles/feature-comparison-between-sep-121-sbe-and-ee

Hello,

I agree, in case you are using the Symantec Endpoint Protection SBE 12.1, you may not see the "External Logging" feature.

However, in case of Symantec Endpoint Protection 12.1 (Enterprise Edition), you may like to Check these Threads: 

https://www-secure.symantec.com/connect/forums/how-configure-external-logging-ssim-symantec-endpoint-protection

https://www-secure.symantec.com/connect/forums/forwarding-logs-syslog-server

https://www-secure.symantec.com/connect/forums/syslog-output-sepm

and this Article:

Exporting data to a Syslog server

http://www.symantec.com/docs/HOWTO27571

Hope that helps!!!

Thank you Mithun for your response. With the attached screen shot what you make out of it? Is it SBE or EE edition? Kindly comment

Looks like Enterprise Edition. Are you logging in as limited administrator or full SEPM admin?

The option should be just fine under Local site:

Hello,

That is Symantec Endpoint Protection Manager 12.1 RU1 MP1 Enterprise Edition.

If it would have been Symantec Endpoint Protection Manager 12.1 RU1 MP1 SBE, then you may have seen it like this:

Are you logged in as "admin" OR the System Administrator of SEPM?

In case you are logged in as a Administrator OR Limited Administrator, you may need to proper Site Rights.

Secondly, check these Screenshots, properly it is under :

SEPM >> Admin >> Servers >> Local Site  >> Configure External Logging

Hope that helps!!

Actually , this access is shown by systeam not me, how can i verify I'm shown the view of sepm admin or limited admin? Any method.

Is there a unique of finding out as to what rights/level/role the person is currently logged in?

Go into the Admin tab -> you should see the currently logged in Administrator -> edit administrator -> on second tab "AccessRights" you should see the type of this admin account.

my answer above...

Under the screenshot I don't want limited admin/ or admin i need system level account for full privileges.

hi,

As per screen shot you can select administrator access rights if you want full rights.

More info look this articals

About administrators

http://www.symantec.com/docs/HOWTO55478

Configuring the access rights for a limited administrator

Managing domains and administrator accounts

Hello,

Exactly. You need the "System Administrator" rights.

When you login as "System Administrator", you may a similar view as below:

Hope that helps!!