topic Re: User ID mapping update in General Topics

User ID mapping update

rz185016 — Sun, 22 Sep 2013 05:23:49 GMT

Hi,

How regularly should the user-id mapping take place in the pan agent.

If I log into the > Program Files> Palo Alto Networks > Panagent folder, and review the user_ip_map

text file, it shows the last dated of June, 2013.

But this is the month of Sep, 2013.

Why does this not show the latest, what do I do to update this so it reflects the latest user_ip_map

I do have a lot of "unknown" and I guess this is one of the reason for this.

How do I resolve this.

Kindly advise,

Regards,

Tau

Re: User ID mapping update

HULK — Sun, 22 Sep 2013 07:14:49 GMT

Hello Tau,

Please go through the below mentioned documents, it may help you.

User Identification Tech Note PAN-OS 4.1

Thanks

Re: User ID mapping update

shasnain — Sun, 22 Sep 2013 18:00:01 GMT

Hi,

Can you restart the service for the user id agent and see if that helps. Normally the user identification time out is 45 minutes and probing as 20 minutes.

Thanks,

Syed R Hasnain

Re: User ID mapping update

sjamaluddin — Mon, 23 Sep 2013 22:47:10 GMT

Hello Tau

Are you running another instance of UserID Agent in the same device? I ask, as PAN Agent is what we called our older version of the UserID agent and I wonder if perhaps it has old info whereas your new info. is in another partition / directory.

If so, could you please check to see if there is just this one PAN Agent on this server or if you might also be running a newer version called the UserID agent?

Thanks

Saba

Re: User ID mapping update

mbutt — Mon, 23 Sep 2013 23:54:38 GMT

Please verify by going on the server to following location, usually where the panagent/userid agent is installed.

C:\Program Files\Palo Alto Networks

Verify if you have two folder or just one

verify which logs did you look at. Make sure you are looking at the logs for which the agent is running,

Also if above is not the case then go to service on the server and verify that the service is running for the userid agent

Also make sure that it is set to automatic and not disabled or manual, other wise you will have to start the service manually when ever the server reboots or restarted.

If that setting is correct as well. Then go to the agent it self and verify that it has not be stopped and it is running.

Hope this helps.

Thanks

Numan