PA-200 Not Showing "Source User" in Monitor logs. Any Ideas?

[pinnergy78701]

Software Version:  7.1.2

User ID Agent:  7.0.4-5

After upgrading the PA and the UIA, the monitor logs are not showing "Source Users".  I've also looked in the  Reports section and it's not showing up there either.

I've also tried to re-configure the Group Mappings again, but no luck.

Any ideas would be greatly appeciated.

[BPry]

We had an issue with our LDAP servers not pulling in updates to groups that was causing issues. The solution turned out being deleting the connections and readding them; after that everything has been workign perfectly. Not sure if you have tried doing so yet?

[pinnergy78701]

I believe I did try that as well, but I went ahead and did that again just to make sure.  Same results; still not showing Source User.

[rmonvon]

Hi...Are you seeing any userID entries when you issue CLI command 'show user ip-user-mapping all'?  If no entries, then the issue is between the agent and the PA.  Otherwise, we would need to check the PA - itsconfig, display option of monitor, etc.

[pinnergy78701]

ok, I ran that show user ip-user-mapping all" command and it showed 23 users.  So I'm guessing the connection is good...

[rmonvon]

The PA is getting UserID info, that's good.    Can you check:

1 - the security zone(s) and make sure the zone for the internal network (where users live) have UserID option enabled.  

2 - Make sure the source user column is active

Thanks,