SAM Template - How many users are currently logged into SolarWinds

How many users are currently logged into SolarWinds?  This is a simple question but actually hard to answer. Solarwinds itself cannot give your answer, IIS server either.

In Solarwinds Database, the table [Orion.Accounts] has columns “AccountID” and “LastLogin” which record a user last seen time (no necessarily login event), but no Client machine (user connects from) details. In table [Orion.AuditingEvents], user logon event (“User xxx logged in from xxx.xxx.xxx.xxx”) is recorded with client IP address. But this is just last login time, not means user still connect now. Also if a user web session is set to “never-expire”, you may not see logon event for days, and if the data retention date is passed, the evet will be removed from database.

On Solarwinds web server, the IIS only gives us a performance counter – total current sessions but no each user details.  But the windows server command “netstat” can give us all network connections to the server with client IP address.

By combination all information above I created a PowerShell component monitor to collect SolarWinds user’s current logon information.  This is relative real time and close to accurate numbers.

• Download and import template “Solarwinds Current Users.apm-template” to you Solarwinds.
• Assign the template to your Solarwinds web server(s).
• Edit the assigned template, for “Solarwinds Current Users” component:

Update “Credential for Monitoring:” A server Credential which can run PowerShell

Update “Script Arguments:” it takes two Arguments: “a-Solarwinds-account, the-account-password”

Done!