> Source: [sk182857](https://support.checkpoint.com/results/sk/sk182857)

# sk182857 - Users appear without a source identity in SmartConsole logs

| Property | Value |
|----------|-------|
| Solution ID | sk182857 |
| Date Created | 2024-12-02 |
| Last Modified | 2024-12-03 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * SmartConsole logs fail to display a source user for certain users.
* The command `# pep show user query cid ` does not display an association.
* The command `# pdp monitor ip ` confirms an association.
* The following command displays mismatched entries in the PEP Kernel tables: `cat $FWDIR/lib/nac_tables.def | grep dynamic | cut -d ' ' -f1 | grep -v idp | awk '{ print ("-t "$0"")}' ORS=" " | awk '{print "fw tab " $0 "-s"}' | bash`

  The command extracts and analyzes dynamic table entries defined in the `nac_tables.def` file. It identifies mismatches in the Policy Enforcement Point (PEP) Kernel tables. Specifically:
  * It lists all dynamic tables defined in `nac_tables.def`, excluding tables related to Identity Protection (IDP).
  * For each table, it retrieves and summarizes its current state using the `fw tab` command.
  * A mismatch occurs when these table entries do not align with expected associations between users and their source IPs, as determined by Identity Awareness configurations.

## Cause

A discrepancy exists in the Identity Awareness Kernel tables.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content