I'd put user_A into the user field, and user_B into the object field. The user is performing the change, the object is being changed. You can use src_user if you have two accounts being used. For example if you see changes made to a database, if your data contains both the account used to log in to the database as well as the account used to log in to the operating system you'd put the database account into user and the operating system account into src_user . If you have a remote log in to some account and also know the account used on the src from where the remote log in originated, that's again the src_user while the account used on the remote system would be the user . ... View more