topic Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas? in General Topics

PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

pinnergy78701 — Mon, 13 Jun 2016 15:56:35 GMT

Software Version: 7.1.2

User ID Agent: 7.0.4-5

After upgrading the PA and the UIA, the monitor logs are not showing "Source Users". I've also looked in the Reports section and it's not showing up there either.

I've also tried to re-configure the Group Mappings again, but no luck.

Any ideas would be greatly appeciated.

Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

BPry — Mon, 13 Jun 2016 16:40:31 GMT

We had an issue with our LDAP servers not pulling in updates to groups that was causing issues. The solution turned out being deleting the connections and readding them; after that everything has been workign perfectly. Not sure if you have tried doing so yet?

Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

pinnergy78701 — Mon, 13 Jun 2016 19:27:42 GMT

I believe I did try that as well, but I went ahead and did that again just to make sure. Same results; still not showing Source User.

Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

rmonvon — Mon, 13 Jun 2016 19:53:07 GMT

Hi...Are you seeing any userID entries when you issue CLI command 'show user ip-user-mapping all'? If no entries, then the issue is between the agent and the PA. Otherwise, we would need to check the PA - itsconfig, display option of monitor, etc.

Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

pinnergy78701 — Mon, 13 Jun 2016 19:59:18 GMT

ok, I ran that show user ip-user-mapping all" command and it showed 23 users. So I'm guessing the connection is good...

Re: PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

rmonvon — Mon, 13 Jun 2016 20:06:02 GMT

The PA is getting UserID info, that's good. Can you check:

1 - the security zone(s) and make sure the zone for the internal network (where users live) have UserID option enabled.

2 - Make sure the source user column is active

Thanks,