2013-12-16 10:25 AM
i just integrated two HPUnix in my SA server then i got, logs are coming as two different device type,refer attached screen shot
is this issue of SA or event source?
2013-12-18 12:36 PM
Hi there.
So, we had an issue with a load balancer showing up as a Junos Router because it was running Junos OS. If your device is running a Junos/Juniper OS, it's being parsed as a Junos device. It's a parsing issue, and you need to tweak your parser to acknowledge the issue, or escalate to RSA's dev team. Hope this helps
2013-12-17 01:38 AM
i think its source, check the session details
2013-12-17 04:09 AM
authentication success log come under HPUnx or authentication failure log coming under junosrouter from same device ip
2013-12-18 08:11 AM
can you post the sample event? looks like both parser hpux and junosrouter enabled.
2013-12-18 08:45 AM
2013-12-18 10:06 AM
Just wondering whether your network has junosrouter or not, which sent the events to SA?
2013-12-18 10:46 AM
no junos router, just check devcie ip, hp unix and junosrouter is same
2013-12-18 10:52 AM
can you export all the logs?
2013-12-18 12:36 PM
Hi there.
So, we had an issue with a load balancer showing up as a Junos Router because it was running Junos OS. If your device is running a Junos/Juniper OS, it's being parsed as a Junos device. It's a parsing issue, and you need to tweak your parser to acknowledge the issue, or escalate to RSA's dev team. Hope this helps