Why does a user named "_cliuser" appear logged in even if there is no such user configured on the device?
27433
Created On 11/23/21 09:44 AM - Last Modified 12/15/25 15:51 PM
Question
1. Why can a user named "_cliuser" be seen listed in the dashboard under the "Logged in Admins" widget?
2. What is the purpose of this user?
Environment
- PAN-OS version 10.0 and above
- Palo Alto Networks Firewall or Panorama
Answer
1. This is an internal user, and as every user, the UI session console shows all usernames logging in to the CLI console.
2. "_cliuser" collects a set of CLI commands for analysis and internal reports in the backend in regular intervals.