topic User-ID records timing out? in General Topics

User-ID records timing out?

SDorsey — Fri, 20 Jun 2014 14:16:54 GMT

I have an environment which has multiple USER-ID agents installed/configure and the agentless option via WMI.

There seems to be an issue with user-id records timing out. After x amount of time, users start matching on a catch all policy at the end because there is no longer a username tied to their IP address. If they log off and back on, it starts working fine again until it times out after x number of minutes.

Is there something simple to resolving this that I am overlooking?

Re: User-ID records timing out?

Wenar — Fri, 20 Jun 2014 14:37:00 GMT

Could it be that the WMI probe doesn't work? If the WMI probe doesn't get a response it deletes the user mapping.

What is the output from debug user-id dump probing-stats?

Re: User-ID records timing out?

SDorsey — Fri, 20 Jun 2014 15:24:13 GMT

I am guessing that is it.

num of initial probe made	: 115617
num of initial probe succeeded	: 3
num of initial probe failed	: 115514
num of periodic probe made	: 14
num of periodic probe succeeded	: 1
num of periodic probe failed	: 13

Now I just need to find out why they are failing.

Re: User-ID records timing out?

sjamaluddin — Fri, 20 Jun 2014 15:28:25 GMT

The PCs that are being probed are likely not set for WMI responses.

As for why it works when the user logs in again, that is how IP to user mappings are made so that makes sense.

In addition to WMI probing, (considering these appear to be failing) you can be monitoring other servers in the Windows domain (e.g. file maps. printers, exchange mail servers) so that you can maintain the mapping and the user does not have to log in to refresh the mappings

To be able to maintain mappings as the user maps drives etc. enable "server session read" on the UserID agent and the UserID agentless on the firewall so even if WMI probes you may have success in maintaining the user to ip mappings without relying solely on when the users log in.

HTH

Re: User-ID records timing out?

Wenar — Fri, 20 Jun 2014 15:32:09 GMT

If you still want to use WMI probing you should verify the user you use for the query. Here is a DOC how you can troubleshoot WMI problems:

How to Troubleshoot WMI