topic Re: User-ID IP mapping in General Topics

User-ID IP mapping

markk96 — Mon, 20 Oct 2014 01:20:41 GMT

Why does some traffic in the logs not have a user tied to the IP address at times even tho in the logs the IP has a user mapped to it most of the time. This is causing policy to be dropped down to a different level.

Re: User-ID IP mapping

ssharma — Mon, 20 Oct 2014 01:26:26 GMT

Hi Markk96,

Most likely reason is there is no mapping at that time for that user for various reason. Once you notice that a user does not have user-name in monitor logs, run following commands :

> show user ip-user-mapping ip <ip_address_in_question>

Most probably you won't see a mapping. We need to find why it disappeared for a while, probably due to timeout (but too early to tell). Hope this helps. Thank you.

Re: User-ID IP mapping

markk96 — Mon, 20 Oct 2014 01:44:30 GMT

For my IP, if I look at the log, it does not do it often, but if I search my ip, and then look at the time stamp. 19:49:52 no user ID, 19:49:53 my user id, then several with my user ID, and then just a random one without my user id.

Re: User-ID IP mapping

ssharma — Mon, 20 Oct 2014 02:17:48 GMT

Based on your symptoms, it is most likely management-plane issue. At the end of the session when logs are generated under traffic logs, mp sends information to log receiver, if any of these process or other process are busy then most likely these information would be missed. In those scenario you will see these blank user-names. What is the software version and hardware model of your device. I would suggest restarting just the processes in question if they are running high. Hope this helps. Thank you.

Re: User-ID IP mapping

markk96 — Mon, 20 Oct 2014 02:20:18 GMT

Running 6.0.3 and I restarted the HA cluster 2 nights ago to see if that would help the problem. It did not.

Re: User-ID IP mapping

ssharma — Mon, 20 Oct 2014 02:26:05 GMT

Other option to troubleshoot would be look at the user id agent's logs to see if there are any information that relates to IP in question. You can run it in debug mode and once you see the issue again, go the same time frame and look for logs related to IP. Thank you.