Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Need help with creating a search for daily user logons.

Prior to upgrading to SEM 2020.4 I used the console app to create a daily search for user logins. Every event tracks multiple items per event. Now we have installed the agent node on more servers so we are seeing daily logins in the 1000s as we are seeing file system access as well. Our current search is UserName = theusername and Event Name = UserLogon. I do have the reports scheduled and sent out but too much info is making this pointless. I am rather new to the product and to this company so I am hoping someone out there has something like this in place.

Thanks!

Vinnie

Find more posts tagged with

Accepted answers

All comments

travis.fenton.41

Hi Vinnie,

I think I understand what you are describing. The 'userlogon' event type is very broad, so it might grab more than you want to see.

There are several options that come to mind (and probably others might chime in as well).

You will want to either Filter IN on more specific events, or Filter OUT stuff you don't want to see.

Filter IN

1-You could add more criteria to your logic. For example you could add the ProviderSID Field and include the Windows Event IDs that correlate to someone logging in.

2-Or you could look at the LogonType Field. There is a difference between Interactive and Network logins.

Filter OUT

1-Same idea as number 2 above, if it were the Network logon types you didn't want to see\capture, you could exclude those from your results by filtering them out.

You said you were newish to the product, so I wanted to show a little of the interface and how you would accomplish these ideas. Sorry if this is already common knowledge to you. Please reach out again if this didn't help, or you have additional questions.

This is to Filter out the Network Logon Type of Events:

(actually not able to insert an image, but I can email you one if you need it)

VinnieISC

I found what I was looking for with this query. EventType = UserLogon AND UserName = "billgates**" AND "Windows Remote Interactive Logon"

VinnieISC

I found what I was looking for with this query. EventType = UserLogon AND UserName = "billgates**" AND "Windows Remote Interactive Logon" I used the ** as wildcards. Works great!

VinnieISC

I found what I was looking for with this query. EventType = UserLogon AND UserName = "billgates**" AND "Windows Remote Interactive Logon" I used the ** as wildcards. Works great!