Report of login, logouts by user

[RSAAdmin]

Hello i need to create a report of login and logout for a specific User, any help on this?

[DavidBruskin]

for what? Against what? enVision, windows,unix, VPN, firewalls, everything? Need some adiditional info.

/db

[RSAAdmin]

just simple reports of login logouts and creat a dashbourd report

[RSAAdmin]

for windows servers

[PatricioDemarch]

See the report into:
Reports-->Windows-->Logon/logoff-->Windows - Logons/logoffs by User

[RSAAdmin]

Hi, I generated this report, and I am not sure that it contains all the users. What can I do to validate this ? Also, I tried to view the loggon/logoff info for a specific user, and it did not work. Here is the SQL request : UserName = 'UserXYZ' AND EventID LIKE '528' OR EventID LIKE '540' OR EventID LIKE '532' OR EventID LIKE '535' thanks for any help

[RSAAdmin]

I would suggest running the built-in report for Windows logon/logoff but if you want to create yours try writing your where clause as follow: UserName LIKE '%UserXYZ%' AND EventID IN ('528','532','535','540')

[RSAAdmin]

Here you go, this report does exactly that.  NOTE:  This will work on Content 2.0, but not earlier versions. 

You may also want to note that many times a logout is not generated by windows.

You will want to run this against your domain controllers, so ensure you have them in a device group first.

It uses a run time parameter for the username, so you can enter anything in to the username text box, and % is wildcard.

To install:

Place the XML file on your A-Serv at E:\nic\version\hostname\etc\reports\custom

Restart your web server

Please let me know if you have any questions.

[RSAAdmin]

Also if you are using windows 2008 servers, then the built in envision reports may not help you, they are setup for 2003 and earlier. They are also not compatible with content 2.0. (Because logs moved to the Windows table from Windows Accounting)

[RSAAdmin]

Hi,

For the better performance of reporting we should use the indexed fields in the SQL... 

So, i would suggest to go with message ID .

Thanks