sorry, i think i misunderstood you, let's go back one step. You asked: "yes but why user is unknown?"
In the current (internal only) Version of today, the two columns are gone, because they made no sense. We have removed them, because for some (most) subsystems we are not able to exactly say who failed to login.
so yes, you are right with the "user unknown" part, but we already fixed it.
So, what's with the 3 hours difference in your view? is it still there?
sorry, i think i misunderstood you, let's go back one step. You asked: "yes but why user is unknown?"
In the current (internal only) Version of today, the two columns are gone, because they made no sense. We have removed them, because for some (most) subsystems we are not able to exactly say who failed to login.
so yes, you are right with the "user unknown" part, but we already fixed it.
So, what's with the 3 hours difference in your view? is it still there?