I have recently added Cisco ACS as a new log source for my Nitro receiver. I am getting logs through. However, what I have noticed is that for login events the username is not parsed and there are no logout events at all. For the majority of the events a username has not been parsed but in the raw log I can see the username. Any ideas why?
Can you post a screenshot of the datasource settings and a sample login event log?