I have a request from management to get a logon logoff report with only the first logon and the last logoff of the day

Well, at the risk of looking like a goof (BTW that NEVER happens ), I'm going to ask what might be a silly question... Are you talking about logins to Orion,  or some other website, app, or database server?

They want to track logon logoff for each user workstation only when they come in the morning and then when they leave at night. They are trying to prevent the cost of another software that can give them this metric.

Olga L Botero - MSM ISS

Network Systems Security Administrator

Bureau of Information Resources

2379 Broad Street, Brooksville, Fl. 34604

tel: 352-796-7211 x4184

Southwest Florida Water Management District<www.swfwmd.state.fl.us/>

Experience is something you don't get until just after you need it (Steven Wright)

Hi,

I know this is an old post but I'm curious if you ever found a solution to what you're looking for? I need to get the same report going and I don't see a way to do it, and sorting of records by date doesn't even work since the date format isn't in a sortable format like EPoch.

-Keith

I do not believe that Orion NPM can provide you this type of data.  The only SW tool that might be able to help you (I think) is Orion Log & Event Manager (aka Orion LEM).  After all, LEM does read Windows Event Logs, so you could possibly setup a rule to look for login/logout events. Still, even if LEM could collect login/logout events, I am also not sure if it could be customized to only report on first login and last logout events.

In any event, I am only guessing, based on what I have read about LEM since I do not even have LEM in our portfolio of SolarWinds tools.  So, for this reason, I would defer to those in this forum who do have real LEM knowledge and expertise.

Best wishes.

We are using LEM but it does not provide this reporting ability, I can't even sort events by date/time due to the format they use for output and support told me this was intentional. (Yuck)

I don't understand how anyone uses this product, so far everything I have tried to do the LEM *almost* does but not quite.. it captures events but you just can't manipulate the data to extract various types of reporting.. totally useless to me. At this point I'm now shopping for a competing products that actually let you manipulate the data so you can quantify and report on it. Oh well.

-Keith