0

Lack of data to describe user logon duration

OS: Windows 2012 R2. Citrix and RES Workspace manager

We have done an installation of uberagent 3.5 and Splunk in a test environment with success. A building block is added to RES to enable the shell data. The agent is up and running and pushing data into Splunk.

70% of the logon duration time is defined as "shell startup" because the customer is using RES Workspace manager to build the desktop.

Can uberagent pick up information from RES about the many different tasks performed. 

My customer do most of the user and desktop administration from RES and the uberagent is not picking up any of this data today.

 

4 comments

  • 0
    Avatar
    Helge Klein

    Hi Reidar,

    You should be able to see what is going on during any logon when clicking the logon's table row on the dashboard "User Logon Duration". That will perform a drilldown to a detail page that lists, amongst a lot of other information, all the processes started as part of the logons along with their dependencies.

  • 0
    Avatar
    Reidar Opem

    The information about the logon processes you mention was empty in my dashboard. This is the case if i logoff less than ten minutes after login. I did a new test where i made sure i was logged in more than 10 minutes and now i have lots of data. 

    It seems like there is a 10 minutes delay on data in sourcetype uberAgent:Process:LogonProcesses

    Maybe you can explain this?

  • 0
    Avatar
    Helge Klein

    Could you send uberAgent's log file from an affected machine to support at uberagent.com, indicating the time at which one of the 10+ minute sessions was logged on?

  • 0
    Avatar
    Reidar Opem

    The logfile is sent to support

Please sign in to leave a comment.