regarding the screenshot: not all of the reporting is shown immediately. to see changes it may take some minutes, because the results are aggregates every 15 minuts or so (depends on which part of the reporting you look at, if it's flash enabled, and so on).
sorry, i think i misunderstood you, let's go back one step. You asked: "yes but why user is unknown?"
In the current (internal only) Version of today, the two columns are gone, because they made no sense. We have removed them, because for some (most) subsystems we are not able to exactly say who failed to login.
so yes, you are right with the "user unknown" part, but we already fixed it.
So, what's with the 3 hours difference in your view? is it still there?