In IDM 6.0.x, Syslog audit event handler, the product name (syslog APP-NAME) is null.
From RFC 5424, APP-NAME should be set:
The APP-NAME field SHOULD identify the device or application that
originated the message. It is a string without further semantics.
It is intended for filtering messages on a relay or collector.