Configuring a failover server for external logging

The Symantec Endpoint Protection Manager acts as a master logging server to forward logs to the syslog server. As of 14.3, you can set up a second management server to act as a failover server for the primary one. If the primary management server goes offline, the second management server takes over and forwards logs to the syslog server. When the primary management server comes back online, it resumes forwarding the logs.
To configure a failover server for external logging
  1. In the console, click
    Admin
    >
    Servers
    , select the site, and click
    Configure External Logging
    .
  2. On the
    General
    tab, in the
    Master Logging Server
    drop-down list, select the primary management server you want to send the logs to.
    If the primary server goes down, the next management server in the list takes over. The management servers are listed in the reporting server priority list on the
    Admin
    >
    Servers
    >
    Edit Site Properties
    >
    General
    tab. 
  3. Click
    OK
    .
More information