[IAG] After a user is moved to another group, the logs for this user for a certain month cannot be found.
Problem Description
There is a user named zhangsan. After he changed departments, his logs could not be found. However, this user could always access the Internet normally. I suspect that the IAG device was not reviewed.
Process——
- Search by IP or username, only logs after February 5th can be found
764645b5a7f09cb9f0.png (213.77 KB) - However, the client's attendance system can see that this user did clock in every day in January.
- Learn from the client that all employees use corporate QQ, so export the IM logs for the first week of January, search for his corporate QQ number, locate the IP he used at the time, and then query the logs by IP.
179505b5a7f96ca6af.png (16.25 KB)
Root cause
Because the user has changed the group, if you check the logs according to the following method, the user's current group path will be included, but the group path of the previously generated logs is different, so the previous logs cannot be queried.
159265b5a7fc31b1d5.png (52.84 KB)
solution
Because the user has changed groups, if you want to check the logs of his old group, you need to query according to the following method, directly enter the user name
772185b5a7fe005fb1.png (17.26 KB)
Suggestions and Conclusion
- QQ numbers can be recorded without enabling the access function.
- If the user has changed the group and wants to query the previous log, the path cannot be included.
Original Link
https://support.sangfor.com.cn/cases/list?product_id=22&type=1&category_id=6096&isOpen=true