1 Reply Latest reply on Jun 15, 2010 7:14 AM by SafeBoot

    User entries stopping being recorded in Audit log


      we are using 5.2.1 about 10% into a rollout of 3,500 devices

      I've been finding a number of users whos entries are not appearing in audit logs, or rather they stop appearing.


      If I look at an audit entry of a device I see the expected


      08/12/2009 15:07:54,0x02000001,"user.name2" (ID=0000028a\Type=00000001),Logon attempt

      08/12/2009 15:07:54,0x04000001,"user.name2" (ID=0000028a\Type=00000001),Logon successful


      with the odd


      14/12/2009 09:07:06,0x01000014,N/A,Check for configuration updates


      then all of a sudden I only see



      30/12/2009 11:23:13,0x01000014,N/A,Check for configuration updates

      01/01/2010 19:14:17,0x01000014,N/A,Check for configuration updates

      03/01/2010 19:41:56,0x01000014,N/A,Check for configuration updates

      04/01/2010 11:11:54,0x01000014,N/A,Check for configuration updates

      08/01/2010 09:12:06,0x01000014,N/A,Check for configuration updates

      08/01/2010 09:26:46,0x01000014,N/A,Check for configuration updates

      10/01/2010 20:51:51,0x01000014,N/A,Check for configuration updates

      11/01/2010 10:25:17,0x01000014,N/A,Check for configuration updates


      looking at the users log (generally I only have one user logging onto a device) I see the log on entries mirrored as per the device log then the log has no more entries once the device log changes to the above


      however I know the users are logging on and restarting, etc


      What is going on?