Skip to main content

vast limits GmbH and uberAgent are now part of Citrix, a business unit of Cloud Software Group. Learn more at

Logon Data Arrives Late or Never in the Backend


  • Logon data for a user session is not available in Splunk immediately. Instead, it arrives after the user logged off.
  • Logon data for a user session is not available in Splunk at all.


The cause is similar to “GP logon script” is longer than “Total duration” and how uberAgent determines the GP logon script phase.

For uberAgent, the phase starts with the process start gpscript.exe /logon. The phase ends when all recursive children of that process are stopped. So, if you have a main logon script that starts other scripts or processes and these continue to run, uberAgent waits for these to stop.

Two situations make uberAgent stop monitoring the logon:

  1. Logoff: the user logs off, which effectively stops all processes in the session, including the ones from your logon script. uberAgent stops the logon monitoring and sends the data to the backend. This typically results in high values for the phase GP logon script.
  2. Logon timeout expires: after 30 minutes, uberAgent stops monitoring the logon. No data about the logon is sent.


Your email address will not be published. Required fields are marked *