As part of the Investigation process, Analysts would search and find what they were looking for, and then continue the investigation. When they come back to the Artifact several minutes later and click Preview they would get a File Not Found error.
File Not Found
When the auth_class = base means the Solera UI is being used. When auth_class=API is used we are not in the Solera UI but calling an API.
Jan 1 12:00:00 localhost httpd[31969]: snlog: sn="<XX!MAC Address!XX>" id="DS" m="6" c="2" event="USER_LOGIN" category="USER" ip="<XX!IP!XX>" model="R620" msg="logmsg=\"model.sys_log::options.event.audit.login_succeeded, user=\"<XX!Username!XX>\", user_id=\"<XX!User-id!XX>\", remote_ip=<XX!IP!XX>, auth_class=\"API\""
The customer was using an API and may have had a timeout associated with their login.