About npiagentini

Hi Santa, Assuming you are running Pearl on your syslog server of choice your line to extract the user and IP from this log will look like this: #Extract user and IP from string if ( $string =~ /user=\<(\w+\.\w+).*rip=(\d+\.\d+\.\d+\.\d+)/ ) { $user = $1 ; $address = $2 }; The exact script will vary based on the syslog server you want to use and how you pass the log text to the script. If you look at the example scripts in the document you will find a Pearl one. If you replace the sample regular expression with the one above all you will need to do is determine how to pass the log data to the script in the first place. Hope this helps! Nick ... View more

Hello, I have had success syslogging off the KDC log from OpenDirectory and then treating like any other syslog integration (UserID API integration using Syslog) If you need any help with the regular expression used in the script just post a sample log with both a user and IP data in it. Have a great evening Nick ... View more

Hi Bob, I can see these messages on my Exchange 2007 server in my lab. Do you have all the exchange roles installed on the same server or did you separate out the CAS role? If we need to dig into the log files it becomes more complex.... Nick ... View more

Hi Bob, Can you check to see if you are getting event 4624 on your Exchange server? Nick ... View more

Hi Bob, I just posted a doc that uses this specific Active Sync event as an example. Would you take a look at it and let me know if it addresses your situation? Using Windows Events as sources for the User-ID XML-API Nick ... View more

Hello, I wonder if it is the result of your using the minimized syntax for the empty tags of <hip-profile/> and <logout/>. While they are perfectly valid XML I have run into some instances where they don't work as expected. If you expand them in your wget do you get the same error? Nick ... View more

Hi Quinton, Windows logoff events are less common then you may think. Most laptop users will just sleep or hibernate when they are leaving, neither of which creates the desired event. With the current version of the user agent the only areas we still have some issues are in high turn over wireless networks where IP's are quickly recycled and reassigned. This is where the API comes in handy. Take a look at for an example of how to set it up. Modification of the scripts are not terribly complex and we are happy to help you out with it on the . I am happy to get into more details on any of your concerns here, just let me know what they are. Nick ... View more

Hi Somphon, I use the API with SYSLOG to do this all the time. If you take a look at this document it has all the basics. See Let me know if that helps! Nick ... View more

Hi Bart, There is no document specific to the API for User ID.The only change to the API functionality in 4.1 is the addition of the ability to add your own SSL certificate to the agent. If you want to see other examples of how to use the API I would recommend the gripping and well written document https://live.paloaltonetworks.com/docs/DOC-1936 . It applies to both 4.0 and 4.1. Nick ... View more

Hi Bart, Just finished updating that one for 4.1. Hot off the presses for you: https://live.paloaltonetworks.com/docs/DOC-3120 Nick ... View more

You are correct. That is why I would use the User ID API with a Log Out script to force the removal of the IP mapping. ( https://live.paloaltonetworks.com/docs/DOC-1348 ). In this way we can create our own log out event.... ... View more

Hi Dieter, The real problem we are hitting here is that you have non domain users as well as domain users and our current design has no real support for local users. If you were having multiple domain users use the sytem, the new log in events would update and all would be well. Instead what happens is there is no event that we track occuring when the local user loggs on. You can define log out scripts in your AD to remove the user from User ID using the API. This would serve to make the local user unknown, which seems to be the result that you want. Does this make sence? Nick ... View more