NetWare Logout event shows User (null) (ipaddress) logged out of server

  • 3994019
  • 25-Jan-2008
  • 28-May-2012


Novell Nsure Audit 1.0.3
Channel - File
NetWare 6.5
Novell NetWare 6.5 SP3


NetWare Logout event shows User (null) (ipaddress) logged out of server server_name
Other events shows the UserId properly


Fix included in naudit103p3.iso

Additional Information

NetWare logout events were not sending originator.
Application of auditnw103p3.exe is recommended afterwards.
Steps to Duplicate:

  • Install NSure Audit 1.0.3 logging server and platform agent on a NetWare 6.5 SP3 server;
  • Configure the Logging Server to log events to the File Channel;
  • Create a Notification for the NetWare Logout event;
  • Configure the server to log eDirectory, NAudit and NetWare Instrumentation
  • Modify the NCP server object, from the "NSure Audit - NetWare" page in iManager,
    to log "Connections - Logout" event;
  • Start/Restart both Engine and Agent and perform a logout operation form the server;
  • Look at sys:\etc\logdir\log and you will see that for the Logout operation the
    userID reported is (null).

Formerly known as TID# 10098654