<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: XML API user-id connected server in Automation/API Discussions</title>
    <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44139#M995</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hi, &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;This is how Kiwi syslog works:&lt;/P&gt;&lt;P&gt;- Match a line&lt;/P&gt;&lt;P&gt;- Execute a script&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;if you don't want a new connection each time, you have to write another script that stay connected to the Agent&lt;/P&gt;&lt;P&gt;and you have to modify the current script to publish the User/IP Mapping to the local script instead the UID agent.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Please note that the UID-Agent can support up to 100 simultaneous connection and if a connection is up 10 min without any message, the connection will be dropped (you can send some keepalive if you want).&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Wed, 14 Nov 2012 12:59:40 GMT</pubDate>
    <dc:creator>cviaud</dc:creator>
    <dc:date>2012-11-14T12:59:40Z</dc:date>
    <item>
      <title>XML API user-id connected server</title>
      <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44138#M994</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;i have successfully setup the XML API using the example provided in the documentation and it is working fine.&lt;/P&gt;&lt;P&gt;i used kiwi syslog and vb script.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;when monitoring using the User-ID agent (version 4.1.5-1) i notice that my Active Directory servers how as connected but my one syslog server shows disconnected with hundreds of entries each having a different port.&amp;nbsp; it is almost like each time the script runs a new connection is made and then disconnected.&lt;/P&gt;&lt;P&gt;here is an example :&lt;/P&gt;&lt;P&gt;Server&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; TYpe&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; Status&lt;/P&gt;&lt;P&gt;10.240.2.68:61409&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; XML API&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; Disconnected (XML API)&lt;/P&gt;&lt;P&gt;10.240.2.68:61665&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; XML API&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; Disconnected (XML API)&lt;/P&gt;&lt;P&gt;10.240.2.68:61921&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; XML API&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; Disconnected (XML API)&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;is this normal or is there a way to keep one connection open for the syslog server?&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;thanks&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 20 Sep 2012 14:28:24 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44138#M994</guid>
      <dc:creator>mark_miller</dc:creator>
      <dc:date>2012-09-20T14:28:24Z</dc:date>
    </item>
    <item>
      <title>Re: XML API user-id connected server</title>
      <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44139#M995</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hi, &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;This is how Kiwi syslog works:&lt;/P&gt;&lt;P&gt;- Match a line&lt;/P&gt;&lt;P&gt;- Execute a script&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;if you don't want a new connection each time, you have to write another script that stay connected to the Agent&lt;/P&gt;&lt;P&gt;and you have to modify the current script to publish the User/IP Mapping to the local script instead the UID agent.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Please note that the UID-Agent can support up to 100 simultaneous connection and if a connection is up 10 min without any message, the connection will be dropped (you can send some keepalive if you want).&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 14 Nov 2012 12:59:40 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44139#M995</guid>
      <dc:creator>cviaud</dc:creator>
      <dc:date>2012-11-14T12:59:40Z</dc:date>
    </item>
    <item>
      <title>Re: XML API user-id connected server</title>
      <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44140#M996</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hi Mark Miller,&lt;/P&gt;&lt;P&gt;Did you successfully setup the XML API with Kiwi Syslog and managed to get UID Agent updated the ip-user-mapping? Do you mind to share how do you did it?&lt;/P&gt;&lt;P&gt;I had setup the Kiwi Syslog with the VB script but it doesn't work. Thanks in advance.&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 11 Apr 2013 23:41:15 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/automation-api-discussions/xml-api-user-id-connected-server/m-p/44140#M996</guid>
      <dc:creator>panda88</dc:creator>
      <dc:date>2013-04-11T23:41:15Z</dc:date>
    </item>
  </channel>
</rss>

