topic Re: Source user not shown in some logs in General Topics

Source user not shown in some logs

david_rivas1 — Mon, 22 Oct 2012 08:05:38 GMT

Hello,

I have developed a script that collects user-ip mapping from a wireless controller and send this info to User-ID Agent. All these looks fine because I can see the users in the User-ID Agent monitor table, but when I look traffic logs on Palo Alto I can see some logs do not have a user identification and other logs have it, for the same source IP. I attach a screenshot where you can see what I am trying to explain :smileysilly:.

The user-ip mapping is correctly catched by PaloAlto.

admin@PA-500> show user ip-user-mapping ip 172.21.8.195

IP address: 172.21.8.195

User: alumnes\zwillis

Ident. By: AD

Idle Timeout: 3581s

Max. TTL: 3581s

Groups that the user belongs to (used in policy)

Does anyone knows what could be happening?

Cheers,

Re: Source user not shown in some logs

shasnain — Mon, 22 Oct 2012 16:53:49 GMT

Hi,

Have you tried increasing the user Identification time out on the User ID agent. The main issue here is the Agent not the PAN. Try increasing the time out to 120 minutes and dis able the netbios probing and only enabling the WMI probing.

Thanks,

Syed Hasnain

Re: Source user not shown in some logs

david_rivas1 — Tue, 23 Oct 2012 14:23:52 GMT

I tied it without success.

That is strange, why I get user ip-mapping throught CLI but it is only shown in some traffic logs. :smileyconfused:

Re: Source user not shown in some logs

sjamaluddin — Wed, 24 Oct 2012 15:32:43 GMT

During the time that the source user does not show in the traffic logs, are the users running a program that may require elevated privileges to Admin? If so, if you have the Admin user in the ignore list, for that one session of traffic when the user is running an application as an Admin, the username may not show.

Re: Source user not shown in some logs

david_rivas1 — Wed, 24 Oct 2012 15:38:52 GMT

The machines of these users are not in domain. That is the reason I used a script (obtain mapping from wireless controller) to send this mapping to the User-ID-Agent. Maybe these users use local admin account for some applications, but I have not configured admin ignoration.

Re: Source user not shown in some logs

acamacho — Thu, 25 Oct 2012 14:56:48 GMT

Please add another snap shot of the traffic log that shows the either screen.. need to see if you are hitting the same rules for the users that are not be identified.

Also click on the detail icon.. Far left the one with the box and magnifying glass and add that snap shot too.

If you have time as well maybe calling into support will help so we can look at it closer.

thank you