What difference are between 'user eq' and 'user in' in filter of traffic logs?
I want to see output which is filtered by partial user-ID not full user-ID.
For example, There are as below user-IDs.
I want to filter for all started 'SA' users in traffic logs.
Solved! Go to Solution.
"eq" will try to match the exact keyword. Could you please try to use "in SA" in the filter (partial match keyword). Please find mentioned KB article for available options: Filtering Traffic Logs for Only Unidentified Users
First, Thanks for your answer.
I already looked above liked document. and I also tried to use "in SA" in the filter.
But I could see nothing logs in traffic logs.
In addition, PANOS is 5.0.10.
"User eq" looks for a exact match that you provide. "User in" however can be used to perform queries such as:
user.src in "cn=test,ou=sec_g,ou=pan,dc=paloaltonetworks,dc=local"
Thus "User in" looks if the user is part of the group.
In your case if all username starting with SA are part of a particular group you can provide a similar query.
Let me know how it works out.
Thanks for your answer, csharma.
But we use xml method not AD with LDAP.
In case, How should I use filtering?
You can do the same thing if you are using XML API, just provide the group entry as follows:
<entry name="plano2003\csharma" ip="192.168.39.209" timeout="20">
<entry%20name="group1"> >>>>>>>>>>>>>>>>>>>>>plano2003/csharma is part of group1
Now if you check the CLI:
admin@39-PA-3020# run show user ip-user-mapping all
IP Vsys From User IdleTimeout(s) MaxTimeout(s)
--------------- ------ ------- -------------------------------- -------------- -------------
192.168.39.209 vsys1 XMLAPI plano2003\csharma 1194 1194
Total: 1 user
admin@39-PA-3020# run show user group list
group1 >>>>>>>>>>>>>>>>>>>>>>>group we just added
Now the query will be modified as follows (user.src in 'group1') where group1 is the group of the users we added through XML API.
In your case you can modify your XML API to make all users starting with 'SA' as one group and users starting with as 'UQ' as part of another group.
Let me know if you have any queries.
Thanks for your answer.
It help me very useful.
But my customer want to filter partial characters on many groups.
Do you know another way excepted same group?
We can not category group by partial characters.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!