In dual-stacked environments where an endpoint has both an IPv4 and IPv6 address, the firewall can now match multiple IPv4 and IPv6 addresses in a single syslog message to obtain IP address-to-username mappings. This eliminates the need to set up an infrastructure to send syslog messages through the firewall multiple times (due to multiple addresses per message). Additionally, the firewall can now parse syslog messages of up to 8,000 bytes to ensure the firewall successfully maps IP address-to-username information from User-ID sources that generate longer syslog messages.