If you have a NAT or terminal server environment and you enabled ip_user_cache, users use the same IP (the IP of the terminal server), hence, you cannot differentiate the users. However, if you configured IWSVA to be able to differentiate the username by disabling ip_user_cache and enabling cookie mode, you will be able to differentiate the users. In this case, delete the previous logs listed with ip_user_cache enabled since it does not allow you to differentiate the users.

This article describes how to empty logs that you can see under Logs > Log Analysis > Internet Access in IWSVA console.

Click image to enlarge.