Locating users that were disconnected that reconnected to their session

6 comments

• 
  Martin Kretzschmar September 24, 2019 09:27 Official comment

  Hi Bill,

  As you know, a session disconnect can occur for a variety of reasons. Either it is user driven, by simply exiting the published application, or it is triggered by the system, like network timeouts or the application exits unexpectedly.

  So just for clarification reasons. Are you interested in a dashboard view for all session states (active/disconnected) over a period of time in correlation with possible events from application errors?

  Please feel free to contact support@uberagent.com directly, if you want to discuss this in greater detail.

   

• 0
  
  Bill Barnes September 24, 2019 14:22

  Hi Martin,

  We have reports from users that they were booted from their session and when they log back in they're reconnected to their session and resume work. We want to be able to track when this happens.The users will start out as active, then they're in a disconnected state and then active again while staying on the same server. We have a report that we communicate to management that has uberAgent / Splunk searches including app crashes and they want to include when someone is booted (active, disconnected, active again on the same server). 

  To summarize, I am taking the approach that sessions that are in the disconnected state were either exiting the app (user closed), some type of network timeout or the app crashed. I can track when the app crashed with uberAgent Application Errors but I would also like to track when there is a network timeout and reconnect.

   

  Thank you for your assistance.  

     

• 0
  
  Dominik Britz September 26, 2019 13:53

  Hi Bill,

  It is an advanced search, I'm not even sure if it is possible. Please understand that I need some time to figure this out.

• 1
  
  Dominik Britz October 01, 2019 08:11

  Hi Bill,

  Sorry for the delay. Here is the search.

  | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
     latest(SessionConnectionState) as SessionConnectionState
     filter SessionConnectionState in (active,disconnected)
     splitrow SessionGUID
     splitrow _time period second
     splitrow User as User
     splitrow host as Host
  | streamstats count reset_on_change=true by SessionConnectionState SessionGUID
  | where count = 1
  | eval IsActive = if (SessionConnectionState="active",1,0)
  | stats
     sum(count) as SessionStateChanges
     latest(User) as User
     latest(Host) as Host
     sum(IsActive) as SumIsActive
     values(_time) as "Session state change times"
     by SessionGUID
  | eval "Session state change times" = strftime('Session state change times',"%Y-%m-%d %H:%M:%S.%Q %z")
  | where SessionStateChanges >= 3 AND SumIsActive >= 2
  | sort User Host
  | table
     User
     Host
     SessionGUID
     SessionStateChanges
     "Session state change times"

  It is very complex so let us look at the individual parts.

  List all sessions over time with where the connection state was active or disconnected:

  | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
     latest(SessionConnectionState) as SessionConnectionState
     filter SessionConnectionState in (active,disconnected)
     splitrow SessionGUID
     splitrow _time period second
     splitrow User as User
     splitrow host as Host

  Add a field to each row where we count the field SessionConnectionState. When the field changes, start from 1 again. With that we labeled every connection state change with a "1":

  | streamstats count reset_on_change=true by SessionConnectionState SessionGUID

  Only leave rows in the list where the count is 1. Also, count the number of active session states:

  | where count = 1
  | eval IsActive = if (SessionConnectionState="active",1,0)

  Do some statistics:

  | stats
     sum(count) as SessionStateChanges
     latest(User) as User
     latest(Host) as Host
     sum(IsActive) as SumIsActive
     values(_time) as "Session state change times"
     by SessionGUID
  | eval "Session state change times" = strftime('Session state change times',"%Y-%m-%d %H:%M:%S.%Q %z")

  This is important. Filter the list to sessions where we saw at least 3 status changes. Also. you wanted to see only active -> disconnected -> active. Hence we have to sort out disconnected -> active -> disconnected. The latter is still in our list, but with SumIsActive >= 2 we will erase it:

  | where SessionStateChanges >= 3 AND SumIsActive >= 2

  Finally, do some sorting and present the table:

  | sort User Host
  | table
     User
     Host
     SessionGUID
     SessionStateChanges
     "Session state change times"

  The result looks like this:

  

  Hope that helps.

• 0
  
  Bill Barnes December 12, 2019 19:47

  Finally getting around to this, I’m sorry for such a long delay. It appears the search string includes a macro that we do not have setup. I suspect we need to create the same macro to match what uberAgent support was using? 

  Error in 'SearchParser': The search specifies a macro 'uA_DM_Session_SessionDetail_Users' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

  Any suggestions? I appreciate the assistance!

  Thank you,

  Bill Barnes

• 0
  
  Dominik Britz December 13, 2019 07:17

  Hi Bill,

  We introduced these macros with version 5.2. Please use

  | pivot uberAgent Session_SessionDetail_Users 

  instead of

  | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users

  if you are on an older version than 5.2.