Connect Server Monitor Failure Logs repetition

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Connect Server Monitor Failure Logs repetition

L1 Bithead

Hello Guys.

Good day.

 

I've found about User-ID logs.

these logs are occurring from now.

스크린샷 2022-08-24 오후 3.40.31.png

How can I solve this problem ?

Should I Check AD DC Server ?

(Luckily, There are no CPU Load, Network Latency)

1 accepted solution

Accepted Solutions

L6 Presenter

Palo Alto uses WMI for resolve user names with the AD and LDAP for getting the AD groups after the username is resolved. Test the WMI:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLs2CAG

 

 

Also enable debugging of the user id to see more usefull info and do some ping tests to the AD controller to see the latency and packet loss and select with ping the correct source ip address that the service route for the User-ID agents uses https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/customize-service-routes-f...

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpCCAS

 

 

 

If you also have issues with the LDAP see link below:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CluWCAS

 

 

As a workaround till the issue is resolved you try client probing or get the user id with redistribution:

 

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping/clie...

 

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-ip-and-user-tag-mappings-redis...

 

 

View solution in original post

4 REPLIES 4

L6 Presenter

Palo Alto uses WMI for resolve user names with the AD and LDAP for getting the AD groups after the username is resolved. Test the WMI:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLs2CAG

 

 

Also enable debugging of the user id to see more usefull info and do some ping tests to the AD controller to see the latency and packet loss and select with ping the correct source ip address that the service route for the User-ID agents uses https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/customize-service-routes-f...

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpCCAS

 

 

 

If you also have issues with the LDAP see link below:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CluWCAS

 

 

As a workaround till the issue is resolved you try client probing or get the user id with redistribution:

 

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping/clie...

 

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-ip-and-user-tag-mappings-redis...

 

 

Thanks.

 

I will try those.

If you managed to get the needed answers, please flag the question as answered.

Sorry, I just done it

  • 1 accepted solution
  • 3098 Views
  • 4 replies
  • 0 Likes
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!