In the audit log table, for the Enforce login activity, we see the username as below:
E.g. Username: Administrator
For any other activities, we see the same username with a number in the bracket
E.g. Username: Administrator(1)
This can cause issues if customers use Syslog to pull the data from the audit log table. Syslog considers the above user as a different user because of the brackets when actually it is the same user.
This is by design.