I need a solution
The condition was that syslog received syslog messages from sepm, but it seemd that facility settings was not included, in this case, syslog server could not classify these messages to corresponding files.
My question is that if sepm send syslog with facility settings inside or not?