Unknown User

[mcvosi]

What causes an unknown user? I'm running the User Agent (2.3) on one of my Domain Controllers, and it picks up SOME users, but not all. I couldn't find any logs to check, aside from the service log for the User Agent.

[Oliver Kaiser]

There are various troubleshooting steps that can be done to verify why this is happening. Before sending you the required commands could you tell me which version of FMC and sensor (FTD or Firepower module?) you are using?

[mcvosi]

Latest version 6.1.

[Oliver Kaiser]

Connect to your FMC using SSH and execute the following two commands. Let me know if any of the two returns any data and post your results here

cat /var/log/messages | grep Duplicate

cat /var/log/messages | grep "Invalid engine 0"

Considering your image... Are you using FTD (unified image) or the firepower module on ASA? And how many users are you syncing - any chance there are > 1500 Users in any group you sync?

[mcvosi]

Less than 100 users. Using modules on my ASA's.

[crusier2015]

Here the same scenario and problem, do you have a sugestion to fix ?

[mcvosi]

I haven't seen any resolution yet. I guess when they release an update.

[mcvosi]

No results.

[Oliver Kaiser]

Your issue sounds a lot like CSCvb63664. You might wanna check out the conditions and verify according to the information listed in the bug.

[mcvosi]

I had the same problem on 6.0.1 though, not just 6.1.

[Oliver Kaiser]

The bug description (affected versions) might not be correct, so you might wanna still check it. In my experience issues like that are mostly related to bugs or malformed user entries that cant be processed by agent or FMC.