Why does the Audit Log show 'Unknown' for who made an update?

Environment:

Object Audit Log Report
All product versions

Resolution:

There are various scenarios where the account that creates/modifies a record, and the particular account associated with the action is not relevant. In such cases the source field, that is recorded, is helpful to determine why.

For example, synchronous CPMs are run within a process that matches the source of the action (create or update). If the source is a utility, such as is the case for incidents modified via email, then the account associated with updates made by synchronous CPMs triggered by the email create/update to an incident, is expected to be 'Unknown'. This is the case for the create transaction in this scenario as well, when an email is processed by a site utility to create an incident. Incidents created from the Ask a Question page will also behave in this way. In the case of asynchronous CPMs, they are always run by a utility, and therefore 'Unknown' can be expected.

Also, transactions that had previously been associated with an existing account will show as 'Unknown' if the associated account has since been deleted.