Symptom

Audit Logs are displaying Admin and System as policy deployment task owners instead of the original custom/external admin user. GUI and SYSLOG.

Conditions

This issue was initially found and reproduced on FMC running 6.2.3.7. This issue might be reproducible on other 6.x versions as well (to be confirmed). - FMC managing 3D devices (7000/8000) series with custom/external admin users; - FMC under same conditions as above with external logging enabled (SYSLOG).

Workaround

On small deployments, it's possible to track the task back to its original owner by checking the pre deployment tasks. This might be almost impossible in larger deployments with multiple admin users and devices.

Further Problem Description