GSuite incomplete reporting

[Oaktech]

Folks,

 

I've got a couple of safeguarding alerts for search terms which have been blocked suitably, however, I've gone digging and whilst I know which device it was from it's IP I don't have a user recorded against either the Smoothwall alert or the device in GSuite.

 

I assume no logged user in the cloud filter because activity says only 1 minutes on the device but I don't know why it wouldn't have recorded the device user in GSuite?

 

I've been through GAM and exported recent users to CSV and the entry for the device ID shows blank for recent users too.

 

All devices are set up identically and I can't seem to find a reason why some devices are recording user history as expected, and some are not.

 

Any ideas?

[paulkerton]

Folks,

I assume no logged user in the cloud filter because activity says only 1 minutes on the device but I don't know why it wouldn't have recorded the device user in GSuite?

 

It logs the WAN address, not the LAN address - that would be the job of your filtering.

[Oaktech]

It logs the WAN address, not the LAN address - that would be the job of your filtering.

 

It logs both and I have other devices where it has recorded the last logged on user?

 

- no recent user recorded but both lan and wan addresses

 

- recent user recorded

 

Both these devices show last updated times within 10 minutes of each other so I'm a bit confused. I have over 100 devices and perhaps 10-15 which are not recording the last logged on user.

[TwistedHelixis]

Have you checked DNS, just in case you have duplicate IPs, or something odd there.

[Oaktech]

Have you checked DNS, just in case you have duplicate IPs, or something odd there.

 

No issues that I'm aware of - I would have thought I would have seen more problems if I had a DHCP or DNS issue?

[TwistedHelixis]

I would have thought I would have seen more problems if I had a DHCP or DNS issue?

 

Not necessarily, A good few times in the past, the only times I new about DNS issues was when SIMS couldn't update a client, other than that we had no other issues reported and everything seemed fine. Normally this would be a few devices using the same IP. Obviously we had deeper DHCP / DNS issues to resolve, but its not always something you might notice.

[PotNoodleTech]

Google reporting is pretty poor (unless you pay through the nose for the non free version).

 

It should show last logged on user though - you checked in User and Browser settings and Device settings there's quite a few things to do with reporting and data collection on there that you may want to turn on.