User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs

Wildman85 — Tue, 08 May 2018 09:11:30 GMT

Hi guys,

I've installed the Palo User-ID agent on a single domain controller (8.0.906) using the Palo Networks guide below:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent/install-the-windows-based-user-id-agent

Our environment already has User-ID running and is working, but due to some server retirement we have had to change the placement of this application.

So I installed the application, gave the dedicated domain service account full control over the Palo User-ID application folder, full control over the registry keys in Wow6432Node (ensured child object permissions for both were replaced) and the service account is already a member of the required AD builtin groups.

I've then added the new server to firewall and confirmed it is connected (change commited).

However the logs under Monitoring does not show any activity for user ID collections, the old (existing) server is still pulling them out OK. The only entries I am seeing are:

need to alloc xxxx bytes for big body

I understand this one is normal and can be ignored (https://live.paloaltonetworks.com/t5/Management-Articles/quot-Warn-839-quot-message-seen-in-User-ID-agent-logs/ta-p/104091)

New connection 127.0.0.1 : 61332
Device thread 0 with 127.0.0.1 : 61332 is started.
Device thread 0 accept finish.

Which I assume is it connecting to itself (domain controller) OK.

can't get prefix from address()

I then see this event a lot, I've modified the include/exclude address ranges (192.168.0.0/16) on the Discovery option but I can't get this to work.

Any ideas?

Re: User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs

Wildman85 — Tue, 08 May 2018 10:47:39 GMT

Only difference I can see is that my working server is using 7.0.713 instead.

Installed 8.0.906 on a member server and that has the same issue.

can't get prefix from address()

Re: User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs

Wildman85 — Tue, 08 May 2018 11:09:59 GMT

Installing 7.0.7-13 works. So I'll stick with that one I guess. Would be to know why the newer version(s) are causing that error.

topic User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs in General Topics

User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs

Re: User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs

Re: User-ID Agent installed on Domain Controller doesn't appear to be collecting event logs