User Logoff Metrics
Group Policy Logoff Script Time
uberAgent collects the duration of the Group Policy logoff script.
Details
- Source type: uberAgent:Logoff:GroupPolicyLogoffScriptTimeMs
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting: LogonDetail
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | |
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | |
| User | User name | String | Domain\JohnDoe | |
| GroupPolicyLogoffScriptTimeMs | Group Policy logoff script processing time | Number | ms | 358 |
Logoff performance
uberAgent collects logoff performance information like disk footprint and process start count.
Details
- Source type: uberAgent:Logoff:LogoffPerformance
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting: LogonDetail
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| ProcessStartCount | Number of processes started | Number | 8 | |
| IOCountRead | Count of read I/O operations | Number | 100 | |
| IOCountWrite | Count of write I/O operations | Number | 100 | |
| IOMBRead | Amount of read data volume | Number | MB | 50 |
| IOMBWrite | Amount of write data volume | Number | MB | 50 |
| IOLatencyReadMs | I/O read operation duration divided by count of read I/O operations | Number | ms | 358 |
| IOLatencyWriteMs | I/O write operation duration divided by count of write I/O operations | Number | ms | 358 |
Logoff processes
Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path and CPU footprint.
Details
- Source type: uberAgent:Process:LogoffProcesses
- Used in dashboards: Single Logoff
- Enabled through configuration setting: LogonProcesses
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| ProcName | Process name | String | chrome.exe | |
| ProcID | Process ID | Number | 456 | |
| ProcParentName | Parent process name | String | PowerShell.exe | |
| ProcParentID | Parent process ID | Number | 789 | |
| ProcUser | User who ran the process | String | Domain\JohnDoe | |
| AppId | Associated application ID. Used by uberAgent to lookup application names and populate field AppName. | String | GglChrm | |
| AppVersion | Associated application version | String | 67.0.3396.99 | |
| LogoffProcType | uberAgent groups processes running during logon into types. Possible values: Other, GP logoff script, Session teardown | String | Other | |
| ProcStartTimeRelativeMs | Process relative start time | Number | ms | 16764 |
| ProcLifetimeMs | Process lifetime | Number | ms | 73615 |
| ProcCmdline | Process command line | String | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe –url http://vastlimits.com | |
| ProcPath | Process path | String | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | |
| ProcIOReadCount | Process I/O operation read count | Number | 2000 | |
| ProcIOWriteCount | Process I/O operation write count | Number | 990 | |
| ProcIOReadMB | Process I/O operation read data volume | Number | MB | 100.05 |
| ProcIOWriteMB | Process I/O operation write data volume | Number | MB | 16.06 |
| ProcIOLatencyReadMs | Process I/O operation read latency | String | ms | 300 |
| ProcIOLatencyWriteMs | Process I/O operation write latency | String | ms | 300 |
| ProcNetKBPS | Process generated network traffic | Number | KB | 19.18 |
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | |
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | |
| TotalLogoffDurationMs | Total logoff duration | Number | ms | 40000 |
| SortOrder | Sort order number to sort the table Logoff process performance on the Single Logoff dashboard correctly. | Number | 29 |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| AppName | Associated application name | String | Google Chrome | Splunk data model, Splunk SPL |
Profile Unload Time
uberAgent collects the duration of user profile unloading
Details
- Source type: uberAgent:Logoff:ProfileUnloadTimeMs
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting: LogonDetail
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | |
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | |
| User | User name | String | Domain\JohnDoe | |
| ProfileUnloadTimeMs | User profile unloading time | Number | ms | 300 |
Session Logoff
uberAgent collects information about session logoff like session logoff time.
Details
- Source type: uberAgent:Logoff:SessionLogoffTime
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting: LogonDetail
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | |
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | |
| User | User name | String | Domain\JohnDoe | |
| SessionLogoffTime | Time when the user logged of | String | 2018-07-23 10:06:02 |
Total logoff time
uberAgent collects the total duration of every logoff.
Details
- Source type: uberAgent:Logoff:TotalLogoffTimeMs
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting: LogonDetail
- Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | |
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | |
| User | User name | String | Domain\JohnDoe | |
| TotalLogoffTimeMs | Logoff duration combined for all phases | Number | ms | 40000 |
