Reviewing the Tracking.log we see a lot of user logins with userID 9999

Products

• Security Analytics

Issue/Introduction

Reviewing the Tracking.log we see a lot of user logins with userID 9999

Log message for API:

{"url":"auth\/login","user_id":"9999","browser":"Central Manager Requester","language":"","visit_time":1550000,"local_time":"00:00:00","pageVars":{"login_type":"api"},"sessionVars":{"appliance":"","build":"7.2.2-44195-R730-cmc","tracker_id":""},"pageTitle":"Auth\/Login"}

 

Log message for User (into sensor):

{"url":"auth\/login","user_id":"0005","browser":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36","language":"eng","visit_time":1550000,"local_time":"00:00:00","pageVars":{"login_type":"login"},"sessionVars":{"appliance":"","build":"8.0.2-53045-R730-capture","tracker_id":""},"pageTitle":"Auth\/Login"}

Resolution

See the examples above for Logins from Users and the API.  When a User logs in it does not get recorded as type API.