Intermittent UserID - Syslog Parser -

[NSutfin]

Anyone see this behavior? we are using syslog parser string for userid, no logout action, timeout set to 45 minutes ( default). You can see here that a flow within the same second shows a userid and then blank with same source address. FW running 10.2.7 h-8 . Any ideas? 

[aleksandar.astardzhiev]

Hi @NSutfin ,

Note that traffic logs are generated at the end of the session. Although the logs are generated few seconds apart, the actuall session for each log may have started minutes apart.

Try the following:

- Check the session start timestamp for two logs one with user-id and one without

- Check the user-ID logs to see the timestamp when the user-to-ip mapping was created

- Verify the mapping timeout has not expired for the two session start timestamps

[NSutfin · Accepted solution]

What this actually was (cut out of screenshot), was that the loss of user-id was between different device-groups within a network. As a user was moving through the network encountering several different firewalls, not all firewalls had been set up for user-id. The search that was being used was against the whole group of firewalls using the user ip address.