Thank you for your answer, very long overdue ticket number FB16426295 Sadly as you mentioned, the above solution is too volatile and misses many of the events.

Thank you Eskimo, with sudo eslogger od_group_add od_group_remove > es_apple.log I checked and it turns out that for the event of either adding/removing user, two notifications are being sent. One has UUID populated and username empty, while the other one has username populated and UUID empty. So depending on the timing my client was picking either of those and filtering for username or UUID was giving weird results. I've put in the check msg->event.od_group_add->member->member_type == ES_OD_MEMBER_TYPE_USER_NAME and it fixed it as it's only processing now the event that has username

I also want to mention that I did try to retrieve UUID instead and convert the value using uuid_unparse and later fetch the username based on the UUID but again, the UUID value was correct only sometimes and most of the time it did not correspond to the actual username (or any username)