How do I determine who is logged in and what they are doing?

hebron1212

How can I determine who is logged in at any given time?

And is it possible to see what they are doing or recent activities or pages?

I'm trying to determine if web console activity is the cause of or contributing to performance issues.

We are on Solarwinds 2023.3.1.

Find more posts tagged with

users

orion

Accepted answers

All comments

mesverrum

There are events in the audit log for users who signed in and certain activities in the pages. Not 100% of everything gets logged but enough to give you a ball park sense of how many people are logged in. If you want something more specific you can check the windows IIS logs, they are quite a bit more verbose, although they tend to show IP addresses without associated login names unless you go in and change some logging settings in windows.

hebron1212

Thanks! I'm trying to determine if web console activity is the cause of or contributing to performance issues.

mesverrum

That's one of the strong arguments in favor of buying the Additional Web Server module, it's dirt cheap and allows you to offload the web stuff to a different server than the core app functionalities. I can't tell you how many times over the years I did something aggressive to one of my web servers in a LB pool and just bounced the affected web server and nobody knew any better instead of having to take a whole outage on the app server that would have caused me to have to do a lot more explaining and paperwork.

vinay.by

You can as well use 'Message Center' on your SolarWinds GUI to certain extent to check these details.

Click on ALERTS & ACTIVITY -> Message Center

Select Audit Events - start with all 'action types' and you can as well choose the Time Period. After playing around with it for a while you can select the specific action type that you are interested in like 'User login' for example to check who all logged in and then you can compare them with 'User logout' to validate who all have logged out. Most actions that a user would perform through SolarWinds GUI should be available here (If you are already aware of this option then please ignore this). Hope this helps.

Plus if you have SAM module, apply 'AppInsight for IIS' on the SolarWinds Primary Poller/Additional Web Server where your IIS is running. This might as well help you in understanding if there is a performance issue on your IIS/Web Server.

__PRESENT__PRESENT__PRESENT

__PRESENT

marcrobinson

@vinay.by and @mesverrum have the whole of it. I have run into situations where the IIS log had the details to determine if there were specific user actions involved. Monitoring IIS with SAM is also helpful to let you know the general performance of a given webserver. Otherwise the Message center and the Audit entities can point out specific users and actions to look into. But yeah, IIS logs had all the details if you are looking at user activity specifically. Monitoring IIS with SAM provided historical data reporting, so if you can do that, I would recommend doing it as is helpful when discovering issues with IIS.

bobmarley

Try this, you can enter actual user names in the Case statement.

SELECT tolocal(TimeLoggedUtc) AS [Last Login],

CASE
WHEN AccountID LIKE 'DOMAIN\USER1' THEN 'Bob Marley'
WHEN AccountID LIKE 'DOMAIN\USER1' THEN 'George Smith'
ELSE AccountID
END AS [Name] ,

AuditEventMessage

FROM Orion.AuditingEvents AS AE
WHERE daydiff(timeloggedutc ,getutcdate())<1
AND AE.AuditingActionType.ActionType = 'Orion.UserLogin'
AND AccountID NOT LIKE '%_system%'
AND AccountID NOT LIKE '%websitemaintenance_user%'

ORDER BY TimeLoggedUtc DESC</pre>