Linux Auditd: Why are users showing as unknown?

[kungfu71186]

I'm getting user unknown even though I have the posix accounts populated. Any idea as to why this happens?

=====Edit=====
I missed a step in that I need to generate the local users list. Anyone know if this is supposed to be locally on the indexer or from all the linux boxes?

[doksu · Accepted solution]

Hi rich7177,

The lookup only needs to be populated on the search head.

Cheers,
Doug