I was looking over the users accessing my customer's SAP environment, with one of the team here, and we found that a lot of the users are showing up with two separate user names. for each user, we seem to be getting a username to come in as an IP address and hostname, while the other user name comes in with their SAP user name. I created a table that shows this happening with a lot of the users.
Has anyone experiened anything like this in DCRUM, or does anyone know of a way to fix it so that the user names with the IP address and host name merge into the SAP user name?
Every DC RUM decode extract user name from the traffic when it becomes available and uses it from that point forward. But user name is not available before user actually types this in (or SSO integration passes it). Therefore first couple of changes between client station and the server, before actual logon, will have client IP address reported instead of user name. Add to this the fact that DC RUM typically reports in 5-min intervals and you land in a situation that in the interval when the user logged on, there will be both client IP and user name reported for this interval, from the same client station.
This is most probable reason why you see both IP and name for each client on this kind of report. With time an operation name dimensions added, it would become clearer. It would be even more precise on ADS report for the user activity (filtered by client IP).
Of course we can't exclude the possibility of a bug in the decode that causes loss of user name recognition, but in order to pursue this route, first the probable cause should lie confirmed.