update to Syslog header format in SEP
Here is an example of the log from MR5’s update (the system I just patched to test it for this case):
<54>Mar 10 13:58:36 SymantecServer w2k3ee2: Site: My Site,Server: w2k3ee2,Cleaned up 1 LiveUpdate downloaded content
So the problem is that it is now using Facility/Date/"SymantecServer"/hostname where it is SUPPOSED to be sending log format as Facility/Date/hostname/"SymantecServer"
Note the location of the name "SymantecServer". It should come AFTER the hostname in the syslog header, not before it.