Why is the firewall displaying "__telemetryuser" as one of the admin user when it is not configured?
Question
Why is the user named "__telemetryuser" displayed when running "show admin local all" command and in "Administrators"?
Environment
- Next-Gen Firewalls
- Panorama
- Telemetry
Answer
- The user "__telemetryuser" with "Device Administrator" role is added when Telemetry is enabled on the firewall.
-
Purpose: This account is used internally by the firewall to collect and transmit operational and statistics data (telemetry) to Palo Alto Networks Cloud Services, such as the Customer Support Portal (CSP), for analysis and to enhance threat intelligence, AIOps, and other services.
-
Functionality: Device Telemetry is an important feature that securely uploads data about the firewall's health, performance, and feature usage. This data is anonymized and helps Palo Alto Networks improve their products and services.
-
Configuration: Telemetry can be enabled or disabled under Device > Setup > Management > Device Telemetry. When enabled, the
__telemetryuserfacilitates the automated, secure transfer of this data.