Empty User ID source Field in Traffic logs - Find authentication AD server
14173
Created On 06/08/22 03:08 AM - Last Modified 09/08/22 18:38 PM
Symptom
When monitoring traffic logs using GUI> Monitor > Traffic, User-id is missing for some traffic in traffic logs.
Environment
- PAN-OS 9.1 and above.
- Any Palo Alto Firewall.
- User ID Agent (UIA)
- Traffic Logs
- Client machine - Windows
Cause
User ID Agent (UIA) server is not monitoring the AD server to which user is authenticated .
Resolution
- From client machine verify which AD Server they are getting connected to, using
- Click Start and enter CMD (Windows Vista/7/2008) or Start > Run > CMD (Windows XP/2003)
- When the CMD window opens, enter the following and hit enter:
echo %logonserver%
- The logon server will be displayed.
- Verify if the AD server details obtained from above output is added in User ID Agent configuration to monitor this AD server event logs ,only then this user-ip mapping information will be sent from AD server to UIA .
- If this AD server is missing in UIA configuration, add the same to resolve this issue.