We use the Arcsight WMI pull feature not the log forwarder. It's all syslog I don't know why one would not be readable.
Clik here to view.

We use the Arcsight WMI pull feature not the log forwarder. It's all syslog I don't know why one would not be readable.