Hi Santa, Assuming you are running Pearl on your syslog server of choice your line to extract the user and IP from this log will look like this: #Extract user and IP from string if ( $string =~ /user=\<(\w+\.\w+).*rip=(\d+\.\d+\.\d+\.\d+)/ ) { $user = $1 ; $address = $2 }; The exact script will vary based on the syslog server you want to use and how you pass the log text to the script. If you look at the example scripts in the document you will find a Pearl one. If you replace the sample regular expression with the one above all you will need to do is determine how to pass the log data to the script in the first place. Hope this helps! Nick ... View more

Hello, I have had success syslogging off the KDC log from OpenDirectory and then treating like any other syslog integration (UserID API integration using Syslog) If you need any help with the regular expression used in the script just post a sample log with both a user and IP data in it. Have a great evening Nick ... View more

Hi Bob, I can see these messages on my Exchange 2007 server in my lab. Do you have all the exchange roles installed on the same server or did you separate out the CAS role? If we need to dig into the log files it becomes more complex.... Nick ... View more

Hi Bob, Can you check to see if you are getting event 4624 on your Exchange server? Nick ... View more

Hi Bob, I just posted a doc that uses this specific Active Sync event as an example. Would you take a look at it and let me know if it addresses your situation? Using Windows Events as sources for the User-ID XML-API Nick ... View more

Hello, I wonder if it is the result of your using the minimized syntax for the empty tags of <hip-profile/> and <logout/>. While they are perfectly valid XML I have run into some instances where they don't work as expected. If you expand them in your wget do you get the same error? Nick ... View more

Hi Quinton, Windows logoff events are less common then you may think. Most laptop users will just sleep or hibernate when they are leaving, neither of which creates the desired event. With the current version of the user agent the only areas we still have some issues are in high turn over wireless networks where IP's are quickly recycled and reassigned. This is where the API comes in handy. Take a look at for an example of how to set it up. Modification of the scripts are not terribly complex and we are happy to help you out with it on the . I am happy to get into more details on any of your concerns here, just let me know what they are. Nick ... View more

Hi Somphon, I use the API with SYSLOG to do this all the time. If you take a look at this document it has all the basics. See Let me know if that helps! Nick ... View more

Hi Bart, There is no document specific to the API for User ID.The only change to the API functionality in 4.1 is the addition of the ability to add your own SSL certificate to the agent. If you want to see other examples of how to use the API I would recommend the gripping and well written document https://live.paloaltonetworks.com/docs/DOC-1936 . It applies to both 4.0 and 4.1. Nick ... View more

Hi Bart, Just finished updating that one for 4.1. Hot off the presses for you: https://live.paloaltonetworks.com/docs/DOC-3120 Nick ... View more