User
The user field is in every FortiRecorder log message where subtype=admin. The user field indicates which login performed the action that is recorded in the event, or, in the case of actions performed by FortiRecorder, system or the name of the daemon.