we are getting started with LEM, and have it emailing failed authentication attempts.. bu in the event it shows ***** as the uname? Is there anyway to see the actual username
The data displayed in LEM is what was contained in the original event on the originating device / node.
You may have to look at the source to see if there is a configuration to display the username instead of asterisks.
LEM does not modify the data in any way other than to normalize the format.
The username on the ASA is displayed as clear text, the password is displayed as *******
Do you have a screenshot of the event in LEM?
It may be a normalization error. Are you on the latest version of the Cisco IOS connector? Can you update and see if the issue persists? Otherwise, this will need to go to Support.
