Documentation

Contents
Contents

User Logoff Metrics

Group Policy Logoff Script Time

uberAgent collects the duration of the Group Policy logoff script.

Details

  • Source type: uberAgent:Logoff:GroupPolicyLogoffScriptTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
User User name String Domain\JohnDoe
GroupPolicyLogoffScriptTimeMs Group Policy logoff script processing time Number ms 358

Logoff performance

uberAgent collects logoff performance information like disk footprint and process start count.

Details

  • Source type: uberAgent:Logoff:LogoffPerformance
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
ProcessStartCount Number of processes started Number 8
IOCountRead Count of read I/O operations Number 100
IOCountWrite Count of write I/O operations Number 100
IOMBRead Amount of read data volume Number MB 50
IOMBWrite Amount of write data volume Number MB 50
IOLatencyReadMs I/O read operation duration divided by count of read I/O operations Number ms 358
IOLatencyWriteMs I/O write operation duration divided by count of write I/O operations Number ms 358

Logoff processes

Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path and CPU footprint.

Details

  • Source type: uberAgent:Process:LogoffProcesses
  • Used in dashboards: Single Logoff
  • Enabled through configuration setting: LogonProcesses
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
ProcName Process name String chrome.exe
ProcID Process ID Number 456
ProcParentName Parent process name String PowerShell.exe
ProcParentID Parent process ID Number 789
ProcUser User who ran the process String Domain\JohnDoe
AppId Associated application ID. Used by uberAgent to lookup application names and populate field AppName. String GglChrm
AppVersion Associated application version String 67.0.3396.99
LogoffProcType uberAgent groups processes running during logon into types. Possible values: Other, GP logoff script, Session teardown String Other
ProcStartTimeRelativeMs Process relative start time Number ms 16764
ProcLifetimeMs Process lifetime Number ms 73615
ProcCmdline Process command line String C:\Program Files (x86)\Google\Chrome\Application\chrome.exe –url http://vastlimits.com
ProcPath Process path String C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
ProcIOReadCount Process I/O operation read count Number 2000
ProcIOWriteCount Process I/O operation write count Number 990
ProcIOReadMB Process I/O operation read data volume Number MB 100.05
ProcIOWriteMB Process I/O operation write data volume Number MB 16.06
ProcIOLatencyReadMs Process I/O operation read latency String ms 300
ProcIOLatencyWriteMs Process I/O operation write latency String ms 300
ProcNetKBPS Process generated network traffic Number KB 19.18
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
TotalLogoffDurationMs Total logoff duration Number ms 40000
SortOrder Sort order number to sort the table Logoff process performance on the Single Logoff dashboard correctly. Number 29

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Associated application name String Google Chrome Splunk data model, Splunk SPL

Profile Unload Time

uberAgent collects the duration of user profile unloading

Details

  • Source type: uberAgent:Logoff:ProfileUnloadTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
User User name String Domain\JohnDoe
ProfileUnloadTimeMs User profile unloading time Number ms 300

Session Logoff

uberAgent collects information about session logoff like session logoff time.

Details

  • Source type: uberAgent:Logoff:SessionLogoffTime
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
User User name String Domain\JohnDoe
SessionLogoffTime Time when the user logged of String 2018-07-23 10:06:02

Total logoff time

uberAgent collects the total duration of every logoff.

Details

  • Source type: uberAgent:Logoff:TotalLogoffTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
User User name String Domain\JohnDoe
TotalLogoffTimeMs Logoff duration combined for all phases Number ms 40000