PIM: 監査ログに出力される存在しないユーザ情報について
Article ID: 372339
Updated On:
Products
Issue/Introduction
In Privileged Identity Manager (PIM), users who do not exist in seosdb or /etc/passwd are appearing in the audit logs.
<Date&Time> W FILE <non-existent user> Write 202 4 ...
Environment
Privileged Identity Manager: All Linux/UNIX versions
Privileged Access Manager Server Control: All Linux/UNIX versions
Cause
The user in question does not currently exist, but it is assumed that the process was started under this user's name and then deleted.
When a process accesses something, the access is recorded as being from the user who started it, so it appears as if the access was from a non-existent user.
Resolution
1. Stop the process in question and restart it.
2. Check the contents of the LADB.
If the user in question still exists in the LADB, delete it.
Next, to confirm if the deletion was successful.
<LADB confirmation>
#sebuildla -U
<LADB Rebuild>
#sebuildla -u
Additional Information
This KB article is a translation and supplement to the following English KB article.
Article ID: 77669: About user info displayed by audit log
Feedback
