<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: User ID agent in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/user-id-agent/m-p/124892#M46375</link>
    <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/46009"&gt;@Kaliman﻿&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;A couple of megabytes should suffice (about 10mb). the UserID agent does not hold a traditional log file, it basically has a flat file containing the actual list of user to ip mappings (a text file, really) which is updated on the fly (entries added and deleted live)&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The UserID agent will read the ActiveDirectory event logs for entries, but will not store these, it will simply collect user and IP information from 'logon success' and similar events, and add these to a flat file and forward the information to all it's connected firewalls. as soon as an entry becomes obsolete (idle timeout, probe fail, ...) , it will be removed from that flat list, and the connected firewalls will also be informed&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Tue, 08 Nov 2016 09:12:56 GMT</pubDate>
    <dc:creator>reaper</dc:creator>
    <dc:date>2016-11-08T09:12:56Z</dc:date>
    <item>
      <title>User ID agent</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/user-id-agent/m-p/124730#M46359</link>
      <description>&lt;P&gt;Hello,&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I am integrating User ID agent on a multi domain invironment.&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have around 14000 users total. What are the System requirements to spin a VM machine where I will install the User ID agent.&lt;/P&gt;&lt;P&gt;to be specific, my client is asking what is the amount of HD that we need to recerve for those user ID logs.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Please let me know any ideas.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thank you in advance.&lt;/P&gt;</description>
      <pubDate>Mon, 07 Nov 2016 19:08:02 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/user-id-agent/m-p/124730#M46359</guid>
      <dc:creator>Kaliman</dc:creator>
      <dc:date>2016-11-07T19:08:02Z</dc:date>
    </item>
    <item>
      <title>Re: User ID agent</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/user-id-agent/m-p/124892#M46375</link>
      <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/46009"&gt;@Kaliman﻿&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;A couple of megabytes should suffice (about 10mb). the UserID agent does not hold a traditional log file, it basically has a flat file containing the actual list of user to ip mappings (a text file, really) which is updated on the fly (entries added and deleted live)&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The UserID agent will read the ActiveDirectory event logs for entries, but will not store these, it will simply collect user and IP information from 'logon success' and similar events, and add these to a flat file and forward the information to all it's connected firewalls. as soon as an entry becomes obsolete (idle timeout, probe fail, ...) , it will be removed from that flat list, and the connected firewalls will also be informed&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 08 Nov 2016 09:12:56 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/user-id-agent/m-p/124892#M46375</guid>
      <dc:creator>reaper</dc:creator>
      <dc:date>2016-11-08T09:12:56Z</dc:date>
    </item>
  </channel>
</rss>

