Double running Pan Agent - Precedence

[CRHC]

Hello,

We have Pan Agents running on 2 servers - querying against the same list of AD controllers.  Is there a precedence that the PAN devices will utilize if the Pan Agent logs have 2 entries for the same IP - but not the same user - or none?

For instance one Pan agent has a listing of "192.168.1.10 to _unknown_" and the second Pan Agent has "192.168.1.10 to domain\me".  Which would take precedence as the logged in user?

We are having this inconsistance because we have Netbios scanning disabled (services are disabled on our image).  I understand how this is happening (a small handful of users do not log directly into the domain - so we get some inconsistancies since Netbios is not checking).  However, it appears last known actual domain "user" login wins over "_unknown_".  Is that a true statement?

Thanks so much.

Mike

[swhyte · Accepted solution]

Hello Mike,

in a nutshell which ever pan agent has the event will win.

So, if the pan device asks each pan agent for the user of the same ip, the pan agent that answers last will win.

thanks,

Stephen