topic User-id don't read security log in General Topics

User-id don't read security log

JRSanch — Thu, 20 Feb 2014 12:50:27 GMT

I have several domain controller configurated on user identification configuration in a Palo Alto with 5.0.8 version. Just one of them seems to function properly and if I use the command "show user server-monitor state all" I obtain this:

Server: CD02(vsys: vsys1)

Host: xx.xx.xx.xx

num of log query made : 2

num of log query failed : 0

num of log read : 1519

last record timestamp : 1392899592

last record time : 20140220123312.189137-000

But all other domain controllers say this

Server: CD03(vsys: vsys1) (job 26841981)

Host: xx.xx.xx.xx

num of log query made : 166

num of log query failed : 0

num of log read : 0

last record timestamp : 0

last record time :

The user to consults secutrity logs is the same for all domain controllers, and have the same rights on all of them. The only difference is that the domain controller that works is windows 2008 and the others are windows 2008 R2.

Someone has an idea of what is the problem?

Re: User-id don't read security log

hshah — Fri, 21 Feb 2014 18:14:42 GMT

Hi JRanch,

Please verify following things.

1. Users have all of the following permission..- I know you have mentioned users have all the permission, but please double check.

Distributed com user

Event log reader

Server operator

Domain admin

WMI permission set

2. Please do tcpdump on firewall for those DC, and check what information is being exchanged. This might provide info if anything is wrong at server end.

3. Also run "netstat -n" continously on DC to see connection requests made by Firewall.

Regards,

Hardik Shah

Re: User-id don't read security log

pulukas — Sat, 22 Feb 2014 16:01:00 GMT

I would also confirm that the Server Windows firewall settings are the same between the working and non-working servers.

Re: User-id don't read security log

Retired Member — Sat, 22 Feb 2014 18:36:39 GMT

can you install an agent and add that DC to see if agent can monitor the users or not ?

this will make you to be sure; if the problem is related to DC or agentless system.

Re: User-id don't read security log

JRSanch — Tue, 25 Mar 2014 06:46:19 GMT

Hi, finally the domain controllers (windows 2008 R2) was not logging the correct events, now all DC are working.

Thanks for the help