log and reports (traffic forward)

[nora]

Following the normal logs that are generating on my 200D fortigate, I want to know why in 
source it shows me the email address of the users and not the active session directory?
for exemple my session is  "jean.michael" and my email is jean.michael@entreprise.com 

At source level of times it shows me the user with his active session directory and other times
 it shows me the same users with his email address? Please i need your help to understand

[nora]

How long logs remain stored on fortigate?