topic Re: Column "source user name" does not show anything in Logview in General Topics

Column "source user name" does not show anything in Logview

minhhaivietnam — Wed, 17 Nov 2021 08:29:44 GMT

Hello experts,

I am running R81 with blade Identity Awareness.

I enabled this blade , and connect successfully to LDAP server. Then I create access-role (get user from LDAP), and put it in the policy rule like this:

But when I log in into PC with above account (hai2), then I access to some-where. In the logview, (colum Source User Name) it does not show anything about my access-role

Please help me; thank all!

Re: Column "source user name" does not show anything in Logview

Ruan_Kotze — Wed, 17 Nov 2021 10:45:31 GMT

Two things spring to mind:

1. Can you confirm that the users are actually matching the policy you created
2. Make sure "hide user identities" is not enabled in SmartView

Re: Column "source user name" does not show anything in Logview

minhhaivietnam — Wed, 17 Nov 2021 10:47:06 GMT

Hi Ruan,

Yes, I confirm I use exactly user name (which put in rule) to login PC (192.168.1.100).

"hide user identities" => I haven't known where it is, but when I show pdp like this : It said that no information found!

[Expert]# pdp monitor ip 192.168.1.100 ==>(IP of PC I use above)
no information was found for 192.168.1.100

I dont know why

Re: Column "source user name" does not show anything in Logview

the_rock — Mon, 31 Oct 2022 14:04:12 GMT

Apologies for responding for old thread, but I have same issue with a customer. I have no clue what to even look for, as IA blade is configured properly, all the settings were verified, but we are totally puzzled as to why "source user name" does not show anything.

Re: Column "source user name" does not show anything in Logview

Vladimir — Mon, 31 Oct 2022 17:47:34 GMT

I suggest checking if the Successful Logon events are being logged on domain controllers. i think those are event numbers 4624.

Re: Column "source user name" does not show anything in Logview

the_rock — Mon, 31 Oct 2022 17:52:04 GMT

Its Azure AD, so not 100% certain how it works on that end : - (

Re: Column "source user name" does not show anything in Logview

Vladimir — Tue, 01 Nov 2022 16:19:48 GMT

Have you seen this post:

https://community.checkpoint.com/t5/Security-Gateways/Identity-Awareness-using-Azure-AD/td-p/84940

Re: Column "source user name" does not show anything in Logview

the_rock — Tue, 01 Nov 2022 16:21:26 GMT

We have call with CP on this soon, so lets hope we fix it, will update : - )

Re: Column "source user name" does not show anything in Logview

mattiaadon — Mon, 23 Jan 2023 15:20:27 GMT

Hi,

do you have some news about that?

Please let me know, because I have this kind of problem with a customer firewall.

Thank you!

Re: Column "source user name" does not show anything in Logview

minhhaivietnam — Mon, 19 Jun 2023 01:01:33 GMT

Hi bro,

I re-install blade Indentity Awareness, and select account which have domain admin right, then it works. Good luck.