> Source: [sk180310](https://support.checkpoint.com/results/sk/sk180310)

# sk180310 - Identity Awareness Gateway does not show logs for a specific user that is configured in an LDAP Account Unit

| Property | Value |
|----------|-------|
| Solution ID | sk180310 |
| Date Created | 2022-11-29 |
| Last Modified | 2022-11-29 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * In SmartConsole, there are no Identity Awareness logs for a specific user, although there are explicit Access Control rules for that user.

* Outputs of these commands on the Security Gateway are empty:

  * `adlog a query user <USERNAME>`
  * `pdp m u <USERNAME>`

  This means the Security Gateway did not receive events for that user and the Security Gateway did not authenticate that user.
* The *$FWDIR/log/pdpd.elg* log file on the Security Gateway contains these lines:

  `
  [ADLOG_EVENT_PROCESS (TD::Surprise)] ADLOG::EventRejectRegExpFilter::acceptField: Field (username) rejected on filter pattern (^`**SPECIFIC_USERNAME** `$) on value (`**SPECIFIC_USERNAME** `)
  `  
  `
  [ADLOG_EVENT_PROCESS (TD::Surprise)] ADLOG::EventRejectRegExpFilter::acceptEvent: Event rejected due to field (username) on value (`**SPECIFIC_USERNAME** `)
  `  
  `
  [ADLOG_EVENT_PROCESS (TD::Events)] ADLOG::EventHandler::processEvent: Event rejected by filter.
  `  
  `
  [ADLOG_EVENT_PROCESS (TD::Events)] ADLOG::EventManager::processEvent: Event skipped, or processing failed.
  `

## Cause

If you are using the same account in the "LDAP Account Unit" object in SmartConsole and Domain Controller Administrator for logging into different machines, then AD Query excludes that account and rejects events related to it.

As a result, the Security Gateway does not receive events for that account, cannot authenticate this account, and cannot enforce the Access Control rules for it.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content