---
title: Vault Discover New Users
slug: kronpam-how-to-guides/vault-discover-new-users
docTags: 
createdAt: 2025-04-30T11:47:15.785Z
---

This log contains logs of new users created by another user connected to the device on Kron PAM. The packets are sent to the server in the following format:

| **Time**              | Time of the new user's found log                                          |
| --------------------- | ------------------------------------------------------------------------- |
| **deviceIp**          | IP of the device used to create the new user                              |
| **deviceHostname**    | Name of the device used to create the new user                            |
| **tenantId**          | Tenant that the new user was created                                      |
| **usedLoginUsername** | The username of the user who created the new user                         |
| **Status**            | If there is a new user is created                                         |
| **newUser**           | Name of the new user                                                      |
| **Log**               | Activity status is shown if there is an error during the process          |
| **InstanceName**      | The instance by which the new user was created                            |
| **permissions**       | Permission assigned to the newly created user                             |
| **sapmAccount**       | SAPM Account, if the newly created user has been added to an SAPM Account |

The test user creates a new user named adm 10.10.10.10, and Kron PAM detects it, resulting in the following log:

:::BlockQuote
\{time=2025-04-24 16:54:23.73, deviceIp='10.10.10.10', deviceHostname='10.10.10.10', tenantId='krontech', usedLoginUsername='Test', status=FOUND, newUser='adm', log=' Used account for checking new users, could not determine sudo status. ', instanceName='localhost.localdomain', permissions=null, sapmAccount=SapmAccount\{dbId=188, device=10.10.10.10 - 10.10.10.10, secretName='xxxx', config=com.kron.sc.sapm.api.pojo.SapmConfig\@605dbbe2, changePeriod=null, username='Test', password='\{"key\_id":"ce379d23-f0d2-41a0-a7da-a56ebddc0c3d","iv":"zir7/GdQ43hPDUeNvmfRcA==","encrypted\_data":"1rBPJpm9yhcslRUrzRZUHA=="}', previousPassword='null', lastChangeTime=2025-04-24 16:38:14.86, nextChangeTime=null, nextChangeTimeStart4Search=null, nextChangeTimeEnd4Search=null, passwordSeenStatus=UNSEEN, validationStatus=VALID, changeStatus='null', lastAttemptStatus=null, masterAccountId=null, permissions=\[], identicalSapmAccounts=\[], recordLimit4Search=null, validationStatus4Search=null, checkPermission4Search=true, exactMatch4Search=false, accountWithDynamicStrategy=false, acceptedSapmConfigList=null, masterAccountId4Search=null, searchOnlyMasterAccounts=false, searchOnlyOwnRegion=false, deviceIp4Search='null', secondPartSeenUsername='null', firstPartSeenUsername='null', errorMessage='null', successful=true, parentSapmGroup=null, parentSapmName4Search='null', secretType=STATIC, owner='admin', managers=\[], userPermissionLevel=-2147483648, privateType=YES, notificationGroups=\[]}}
:::