9/10/17 5:00:17 PM CDT unknown 0.0.0.0 0 Added ActionSet Block IP Filter success
9/10/17 5:00:17 PM CDT unknown 0.0.0.0 0 Added ActionSet Permit IP Filter success
9/10/17 4:59:38 PM CDT unknown 0.0.0.0 0 Starting activation of DV 3.2.0.9000 success
9/10/17 4:59:38 PM CDT (system) (system) 0 Download Digital Vaccine 3.2.0.9000 from TMC success
The "unknown" user is in this case is a background process that occurs as a result of an action initiated by the system (in this case the DV download/activation). It doesn't reference a specific user account on the device (since it's an automated process that wasn't triggered by a person logging in and performing the action), so the user shows up as "unknown". In this case the unknown user is the same as the "system".
