cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

SAM Template - How many users are currently logged into SolarWinds

How many users are currently logged into SolarWinds?  This is a simple question but actually hard to answer. Solarwinds itself cannot give your answer, IIS server either.

In Solarwinds Database, the table [Orion.Accounts] has columns “AccountID” and “LastLogin” which record a user last seen time (no necessarily login event), but no Client machine (user connects from) details. In table [Orion.AuditingEvents], user logon event (“User xxx logged in from xxx.xxx.xxx.xxx”) is recorded with client IP address. But this is just last login time, not means user still connect now. Also if a user web session is set to “never-expire”, you may not see logon event for days, and if the data retention date is passed, the evet will be removed from database.

On Solarwinds web server, the IIS only gives us a performance counter – total current sessions but no each user details.  But the windows server command “netstat” can give us all network connections to the server with client IP address.

By combination all information above I created a PowerShell component monitor to collect SolarWinds user’s current logon information.  This is relative real time and close to accurate numbers.

  • Download and import template “Solarwinds Current Users.apm-template” to you Solarwinds.
  • Assign the template to your Solarwinds web server(s).
  • Edit the assigned template, for “Solarwinds Current Users” component:

Update “Credential for Monitoring:” A server Credential which can run PowerShell

Update “Script Arguments:” it takes two Arguments: “a-Solarwinds-account, the-account-password”

Done!

001.jpg

002.jpg

Labels (1)
Attachments
Comments

This is great, I am racking my brain on how to implement this and split out the data from an Additional Web Server. When I assign the template monitor to our additional web server, it displays the same data as the main web server. I would like the ability to see the numbers from each web server separately to determine proper load balancing.

Any thoughts on this?

Thanks

Jason

Same here, would be great to see AWS connections.

AppInsight for IIS will show how many connections are on each web server this template is applied.  That may help the load balancing question.  I have this much applied in our environment now.  We have 4 additional web servers.  To get these in a single resource to be easier to see, I created a Custom Table Resource to display the number of connections for each of our web servers.

pastedImage_0.png pastedImage_1.png

The top node in my resulting display is the main engine and we typically don't use that web server.  The other 4 servers are behind an F5.  The connections numbers seem to vary throughout the day.  Sometimes the F5 has them balanced well, other times, not so much.  But the main point of this resource is to look at those numbers, so this works for us.

I'm following your screenshot note for note and I'm not getting any data. Current connections on the Appinsight page shows 12 connections so the data is definitely there.

I'll keep hacking away...

EDIT - I'm showing that my NetPerMon site is not even available in the DS Picker. I see other web sites for other nodes though - any ideas?

I used this, and it works well. My Federal customer is now asking to identify the location of each connection. Can this template be used to identify each connection, say by... IP?

hpstech,

Are you getting a display error like this?

Resource Display 01.PNG

If so, check you resource view limitations on your customize summary. It may be blocking your data.

This only works when I filter the View page to just the AWS server.

But whats odd is a since deleted site, "Default Web Site" shows up on the table even though its gone. I'm sure this is just an inventory bug/shortcoming. I have a feeling if I remove and re-add Appinsight it will be correct.

pastedImage_0.png

Hmm...Not without some kind of script that reads the IIS log I assume.

Or just point SawMill at the log directory and use the Lite version - (great tool) - sawmill.net - Sawmill - Universal log file analysis and reporting

I don't currently have UDT installed, but isn't that part of the function of UDT? I imagine some additional information could be added to the SWQL query or they could take the IP address from the output and search for the user in UDT to find the port they're plugged into, etc.

I guess it would help to know is this to identify internal Intranet connections or External connections. Either way, Appinsight isn't in the business of providing IP to User data. Its nice thought to have though, but IIS is the only source of IIS connections by IP - or, if you're using a load balancer you have that option too I suppose. A PowerShell script to pull IIS W3 log data in real time is a viable option from my newbish vantage point.

Ok so I am using an F5 Load Balancer and have the Main App Server as well as x4 Web Servers. I've downloaded and applied the 'SolarWinds Current Users' SAM Template but am not sure if I have applied it correctly as I'm not getting any results back. Does this still work or do I need AppInsight?

Version history
Revision #:
1 of 1
Last update:
‎09-27-2017 11:30 AM
Updated by: