STAS Users showing XG's IP address in Show Live Users

Hey Tam Ben-Jusu 

To confirm, have you created the recommended IP address and service user exclusions on your STAS collector?

Regards,

Thanks floSupport,

I have the collector and agent IP addresses in the exclusion list and I have the domain admin and sophosadmin account (used to install STAS) in the user logon/logoff exclusion list.

Are there any others I could add that you could advise?

Many thanks again

Hi Mathew ,

I belive you would need to take a sample of the user being affected in Event Viewer and you may filter using Event ID: 4768 and cross reference with the logs on STAS ,

If the Host address on your ADS is not the address you would expect then that would need to be fixed on your end. STAS will pick up the events from your event logs.

Snapshots reference.

Thank you, Aditya..

The Event Viewer on the 2nd domain controller is indeed showing the ip address as that of the XG230, not the correct client host ip.

I have turned off that DC for testing and just have the one agent/collector Domain Controller.

The correct client host ip address is showing in Show Live Users.

I will monitor for disconnects.

Many thanks again.

Thanks again Aditya and everyone..

The 2nd domain controller was newly added to the network and was not in a server group that had a firewall rule applied.

Any traffic to and from the 2nd dc through the XG230 was 'masqueraded' as the XG230 ip address.

I added the dc to the server group and the correct ip address appeared in the Event Logs

Many thanks for all of your help.