is there any issue in SA 10.3?

[RajbirYadav]

i just integrated two HPUnix in my SA server then i got, logs are coming as two different device type,refer attached screen shot

is this issue of SA or event source?

[huanzhou1]

i think its source, check the session details

[RajbirYadav]

authentication success log come under HPUnx or authentication failure log coming under junosrouter from same device ip

[huanzhou1]

can you post the sample event? looks like both parser hpux and junosrouter enabled.

[RajbirYadav]

please, Have a look on this document

[huanzhou1]

Just wondering whether your network has junosrouter or not, which sent the events to SA?

[RajbirYadav]

no junos router, just check devcie ip, hp unix and junosrouter is same

[huanzhou1]

can you export all the logs?

[RSAAdmin · Accepted solution]

Hi there.

So, we had an issue with a load balancer showing up as a Junos Router because it was running Junos OS. If your device is running a Junos/Juniper OS, it's being parsed as a Junos device. It's a parsing issue, and you need to tweak your parser to acknowledge the issue, or escalate to RSA's dev team. Hope this helps