Source user not shown in some logs

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Source user not shown in some logs

Not applicable

Hello,

I have developed a script that collects user-ip mapping from a wireless controller and send this info to User-ID Agent. All these looks fine because I can see the users in the User-ID Agent monitor table, but when I look traffic logs on Palo Alto I can see some logs do not have a user identification and other logs have it, for the same source IP. I attach a screenshot where you can see what I am trying to explain :smileysilly:.

The user-ip mapping is correctly catched by PaloAlto.

admin@PA-500> show user ip-user-mapping ip 172.21.8.195

IP address:  172.21.8.195

User:        alumnes\zwillis

Ident. By:   AD

Idle Timeout: 3581s

Max. TTL:    3581s

Groups that the user belongs to (used in policy)

Does anyone knows what could be happening?

Cheers,

5 REPLIES 5

L4 Transporter

Hi,

Have you tried increasing the user Identification time out on the User ID agent. The main issue here is the Agent not the PAN. Try increasing the time out to 120 minutes and dis able the netbios probing and only enabling the WMI probing.

Thanks,

Syed Hasnain

I tied it without success.

That is strange, why I get user ip-mapping throught CLI but it is only shown in some traffic logs. :smileyconfused:

During the time that the source user does not show in the traffic logs, are the users running a program that may require elevated privileges to Admin? If so, if you have the Admin user in the ignore list, for that one session of traffic when the user is running an application as an Admin, the username may not show.

The machines of these users are not in domain. That is the reason I used a script (obtain mapping from wireless controller) to send this mapping to the User-ID-Agent. Maybe these users use local admin account for some applications, but I have not configured admin ignoration.

Please add another snap shot of the traffic log that shows the either screen.. need to see if you are hitting the same rules for the users that are not be identified.

Also click on the detail icon.. Far left the one with the box and magnifying glass and add that snap shot too.

If you have time as well maybe calling into support will help so we can look at it closer.

thank you

Al

  • 5996 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!