1

Locating users that were disconnected that reconnected to their session

We currently allow users to connect to disconnected sessions up to 4 hours after they get disconnected. Most of our users are connecting over the Internet to our main application. I can see in "user sessions" when a user is disconnected and reconnects to their session, so what happens is the user is "active" on server1 later the session state goes to "disconnected" and then "active" again and is on server1 until he closes the app.In the example below I disconnected twice while testing.

My task is to gather the user names and details when users are "booted" (disconnected) from from their XenApp 7.15 session. I am aware that app crashes will have the similar symptom so we use "application errors" in uberAgent to report on that.

Any ideas or suggestions?

Any assistance would be greatly appreciated!

Thanks

4 comments

  • Avatar
    Martin Kretzschmar Official comment

    Hi Bill,

    As you know, a session disconnect can occur for a variety of reasons. Either it is user driven, by simply exiting the published application, or it is triggered by the system, like network timeouts or the application exits unexpectedly.

    So just for clarification reasons. Are you interested in a dashboard view for all session states (active/disconnected) over a period of time in correlation with possible events from application errors?

    Please feel free to contact support@uberagent.com directly, if you want to discuss this in greater detail.

     

  • 0
    Avatar
    Bill Barnes

    Hi Martin,

    We have reports from users that they were booted from their session and when they log back in they're reconnected to their session and resume work. We want to be able to track when this happens.The users will start out as active, then they're in a disconnected state and then active again while staying on the same server. We have a report that we communicate to management that has uberAgent / Splunk searches including app crashes and they want to include when someone is booted (active, disconnected, active again on the same server). 

    To summarize, I am taking the approach that sessions that are in the disconnected state were either exiting the app (user closed), some type of network timeout or the app crashed. I can track when the app crashed with uberAgent Application Errors but I would also like to track when there is a network timeout and reconnect.

     

    Thank you for your assistance.  

       

  • 0
    Avatar
    Dominik Britz

    Hi Bill,

    It is an advanced search, I'm not even sure if it is possible. Please understand that I need some time to figure this out.

  • 1
    Avatar
    Dominik Britz

    Hi Bill,

    Sorry for the delay. Here is the search.

    | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
    latest(SessionConnectionState) as SessionConnectionState
    filter SessionConnectionState in (active,disconnected)
    splitrow SessionGUID
    splitrow _time period second
    splitrow User as User
    splitrow host as Host
    | streamstats count reset_on_change=true by SessionConnectionState SessionGUID
    | where count = 1
    | eval IsActive = if (SessionConnectionState="active",1,0)
    | stats
    sum(count) as SessionStateChanges
    latest(User) as User
    latest(Host) as Host
    sum(IsActive) as SumIsActive
    values(_time) as "Session state change times"
    by SessionGUID
    | eval "Session state change times" = strftime('Session state change times',"%Y-%m-%d %H:%M:%S.%Q %z")
    | where SessionStateChanges >= 3 AND SumIsActive >= 2
    | sort User Host
    | table
    User
    Host
    SessionGUID
    SessionStateChanges
    "Session state change times"

    It is very complex so let us look at the individual parts.

    List all sessions over time with where the connection state was active or disconnected:

    | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
    latest(SessionConnectionState) as SessionConnectionState
    filter SessionConnectionState in (active,disconnected)
    splitrow SessionGUID
    splitrow _time period second
    splitrow User as User
    splitrow host as Host

    Add a field to each row where we count the field SessionConnectionState. When the field changes, start from 1 again. With that we labeled every connection state change with a "1":

    | streamstats count reset_on_change=true by SessionConnectionState SessionGUID

    Only leave rows in the list where the count is 1. Also, count the number of active session states:

    | where count = 1
    | eval IsActive = if (SessionConnectionState="active",1,0)

    Do some statistics:

    | stats
    sum(count) as SessionStateChanges
    latest(User) as User
    latest(Host) as Host
    sum(IsActive) as SumIsActive
    values(_time) as "Session state change times"
    by SessionGUID
    | eval "Session state change times" = strftime('Session state change times',"%Y-%m-%d %H:%M:%S.%Q %z")

    This is important. Filter the list to sessions where we saw at least 3 status changes. Also. you wanted to see only active -> disconnected -> active. Hence we have to sort out disconnected -> active -> disconnected. The latter is still in our list, but with SumIsActive >= 2 we will erase it:

    | where SessionStateChanges >= 3 AND SumIsActive >= 2

    Finally, do some sorting and present the table:

    | sort User Host
    | table
    User
    Host
    SessionGUID
    SessionStateChanges
    "Session state change times"

    The result looks like this:

    Hope that helps.

Please sign in to leave a comment.