question use Syslog Sender and User ID Agent to do User IP Mappings

[Bin]

I used PAN 6.01 and  followed https://live.paloaltonetworks.com/docs/DOC-6727.

I create a filter as following part for my Aerohive device.

event-regex

auth\:

username-regex       username ([a-zA-Z0-9\_]+)

address-regex

ip ([A-F0-9a-f:.]+)

However, I can see the aerohive traffic log messages in User ID agent log but do not have any User IP Mapping display in the Monitoring.

I user User ID Agent 6.0.1-2

Anybody have ideas?

[hyadavalli]

Hello bin,

Is it possible for you to provide the output of syslog ?

Regards,

Hari Yadavalli