Blank User in Web Filter Reports

[dmorris]

That would explain your issue.
You will need to determine who/what is calling the API and why they are not calling the API in a way that accurately reflects the user's state. Then we'll need to troubleshoot that.

192.168.0.21 sound familiar? who is that?
See top of thread.

[Pilotpak]

Many thx.

192.168.0.21 is a Windows 7 user's workstation. It has a name of ADM-03 on the domain. It is only used by one individual user using his domain login.

Whilst the API problem affects different users, 192.168.0.21 seems to suffer from the problem more often than most other users, maybe once per week. Some users have never experienced any problem at all, but for most part, it just seems to happen randomly to different users.

Setting up of UT was way before my time, so I don't know how the API has been setup.

I've looked at the GPO Logon / logoff scripts and I can't see any reference to any the Untangle USERAPI/REGISTRATION URL there. Seeing that there are API Updates every 5 minutes, I looked for a scheduled task, but can't see any. Is there any way to tell if UT AD Monitor is being used (I couldn't see anything obvious in Active Services) ?

[Pilotpak]

Hi, Can someone explain how Untangle handles the UPDATE API Notification records ?

I assume that the key to the API Updates is the IP Address of a particular device, and I can see these Update Records for each user every 5 minutes, but is there some timer in Untangle so that if the Update Records stop for a particular device, then does that "remove" any user details / Organisational Attributes attached to the user ?

[dmorris]

You likely have some script or program on the device calling the API to tell Untangle which user is logged onto the machine.
Something like the UNLS: https://wiki.untangle.com/index.php/...n_Login_Script

If you're not seeing updates, thats because the API isn't being called. You'll need to investigate the machines to see why it isn't calling the API with the current logged in user to keep Untangle current. Is it not running? Did someone kill it?
If the API isn't being called and the machine is not generating traffic and is not responsive, eventually the entry will be deleted and the username will be forgotten (until the next login/update).

[dmorris]

Also, I don't see any issue in the screenshots.

The few web requests (sophos updates) around 3pm, were just before the admin logged in briefly (probably a periodic tasks).
The machine is idle until around 5pm, there is one request (to msftnfci) to check if the machine is online which is something the O/S does and then the user logs in and all requests are properly identified.
Can you circle which request you think does not have the proper username associated?