If a specific scanning server's transactions always appear on the first page of the policy management console's Web Logs, it might seem like the policy server is favoring a particular scanner.  Without applying a log filter, it might even appear that the policy server is only retrieving logs from one specific scanning server.  In actuality, the most common reason for this symptom is clock synchronization.

Web Logs in the policy management console are sorted by the time at which the log entry was recorded.  Since log entries are initially recorded on the scanning servers, their timestamps are determined by each scanning server's clock.  If one scanning server's clock is slightly ahead of the others, the policy server will always believe that this particular scanning server's events are the newest.  Therefore, log entries from the scanning server with the fastest clock will always be listed first.

It is recommend that the clocks on all Finjan appliances be synchronized as much as possible.  Finjan appliances support Network Time Protocol (NTP), which allows them to synchronize with a time server within the organization or on the public Internet.  For information on configuring NTP, please see the Setup and Configuration Guide for your version of VSOS.

8.5.0
9.0
9.2