Parsers are matched to devices based on internal scoring from header matches. This is what is exposed and enhance in NW11 event source discovery to help provide visual indication of the confidence of a match and allow the admins to force match ones that are very weak matches (rhlinux and others).
In your case, using the device parser option (depending on your version) to map the rhlinux devices to that parser (enabled on the log decoder) to avoid weak matches to other device types. There is a file on the file system that you can edit manually (xml) or using the rest interface (early versions) and then in the UI on each decoder/ config (later 10.6 versions).
forcing a match to a parser should be to ones that are enabled (you want to force matches to a devicetype so that its parsed properly.) Order of the file is important, the parser will match the first one before the second if you have multiple parsers per device forced (rhlinux + apache etc.)
Also make sure that if you start using this force match then you should check regularly for
device.type exists && word exists
which would indicate that you have a forced match but the parsers cant extract useful information and most likely the device.type changed or the parser list is incorrect. (the parser is forcing the device.type but no matching messages exist).
