So to update from my last post. This works, most of the time. I have noticed that some of my users and not being seen correctly by the firewall from the syslog. I am getting org\\user instead of org\user and the PA drops that past my unknown user to ...
I got it!!!Go to Device > Server Profiles > SyslogAdd a profile and add server within profile with the Facility at LOG_LOCAL0Then go back to Device > User Identification > Palo Alto Networks User-ID Agent Setup and go to Server Monitor tab.Change the...