https://live.paloaltonetworks.com/t5/general-topics/server-log-monitor-frequency-and-user-id/m-p/213900#M62186 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/76136">@NavidAlam</a>,</P><P>This is simply how often the firewall/user-agent reads the server logs to pick up on new login events and the such. So essentially it would take&nbsp;<EM>up to</EM> 10 seconds before the firewall started to processes the server logs and started mapping users to new IP addresses.&nbsp;</P><P>There really isn't any relationship between the User-ID timeout and the Server log monitor frequency. The user-id timeout is going to sepcify how long a user is mapped to the IP reqardless if a new log isn't seen. The Server log monitor frequency is how often the firewall is processing the server logs to identify new login events.&nbsp;</P><P>Whether or not you should actually increase this value from the default of 2 seconds to 10 seconds is really dependent on your enviroment. If you work in an enviroment that is largely stable, or your user-id based policies really don't make much of a difference, then it really shouldn't effect anything. If you're in an enviroment where people change location regularly and you use user-id to restrict access via policy, then this change could cause a longer delay between the actual sign-on and the user being allowed access to these restricted destinations.&nbsp;</P> Thu, 10 May 2018 13:05:15 GMT BPry 2018-05-10T13:05:15Z https://live.paloaltonetworks.com/t5/general-topics/server-log-monitor-frequency-and-user-id/m-p/213887#M62181 <P>&nbsp;</P><P>What recommended value for Server Log Monitor Frequency if we increase the from 2 Sec to 10 Sec ?</P><P>&nbsp;</P><P>&nbsp;</P><P>What is the relation between this queries and User Identification Timeout of 600 minutes and Server Log Monitor Freq?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 10 May 2018 11:03:27 GMT https://live.paloaltonetworks.com/t5/general-topics/server-log-monitor-frequency-and-user-id/m-p/213887#M62181 NavidAlam 2018-05-10T11:03:27Z https://live.paloaltonetworks.com/t5/general-topics/server-log-monitor-frequency-and-user-id/m-p/213900#M62186 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/76136">@NavidAlam</a>,</P><P>This is simply how often the firewall/user-agent reads the server logs to pick up on new login events and the such. So essentially it would take&nbsp;<EM>up to</EM> 10 seconds before the firewall started to processes the server logs and started mapping users to new IP addresses.&nbsp;</P><P>There really isn't any relationship between the User-ID timeout and the Server log monitor frequency. The user-id timeout is going to sepcify how long a user is mapped to the IP reqardless if a new log isn't seen. The Server log monitor frequency is how often the firewall is processing the server logs to identify new login events.&nbsp;</P><P>Whether or not you should actually increase this value from the default of 2 seconds to 10 seconds is really dependent on your enviroment. If you work in an enviroment that is largely stable, or your user-id based policies really don't make much of a difference, then it really shouldn't effect anything. If you're in an enviroment where people change location regularly and you use user-id to restrict access via policy, then this change could cause a longer delay between the actual sign-on and the user being allowed access to these restricted destinations.&nbsp;</P> Thu, 10 May 2018 13:05:15 GMT https://live.paloaltonetworks.com/t5/general-topics/server-log-monitor-frequency-and-user-id/m-p/213900#M62186 BPry 2018-05-10T13:05:15Z