topic Re: Intermittent UserID - Syslog Parser - in General Topics

Intermittent UserID - Syslog Parser -

NSutfin — Thu, 15 Aug 2024 13:05:35 GMT

Anyone see this behavior? we are using syslog parser string for userid, no logout action, timeout set to 45 minutes ( default). You can see here that a flow within the same second shows a userid and then blank with same source address. FW running 10.2.7 h-8 . Any ideas?

Re: Intermittent UserID - Syslog Parser -

aleksandar.astardzhiev — Wed, 21 Aug 2024 09:12:07 GMT

Hi @NSutfin ,

Note that traffic logs are generated at the end of the session. Although the logs are generated few seconds apart, the actuall session for each log may have started minutes apart.

Try the following:

- Check the session start timestamp for two logs one with user-id and one without

- Check the user-ID logs to see the timestamp when the user-to-ip mapping was created

- Verify the mapping timeout has not expired for the two session start timestamps

Re: Intermittent UserID - Syslog Parser -

NSutfin — Wed, 18 Sep 2024 15:31:18 GMT

What this actually was (cut out of screenshot), was that the loss of user-id was between different device-groups within a network. As a user was moving through the network encountering several different firewalls, not all firewalls had been set up for user-id. The search that was being used was against the whole group of firewalls using the user ip address.