Who equals to "System", what does that mean ?
Posted 16 April 2018 - 03:31 AM
Posted 17 April 2018 - 06:04 AM
It means that the product was not able to find the corresponding event in the target server security log, and it caused 'System' in the 'Who' field.
What is your current version of the product?
Please check that auditing settings are configured according to the following article:
Posted 16 July 2018 - 07:13 PM
Did you resolve this problem? I have the same issue. I'm going to look into what Paul said...
Posted 19 July 2018 - 06:28 AM
Based on what i experienced, in some cases, "Who=system" is due to Security Log size not set to 4GB and other audit policies that related to File Share Monitoring was set correctly.
But in other cases, where Audit Policy is set correctly and security Log is set 4GB and there is no error on collection.
The captured audit result still can show "Who=System", which i still do not understand...