uberAgent collects various details about logoffs like profile unload time, Group Policy logoff script time as well as process performance.
Details
Source type: uberAgent:Logoff:LogoffDetail
Used in dashboards: User Logoff Duration, Single Logoff
Enabled through configuration setting: LogonDetail
Related configuration settings: n/a
Supported platform: Windows
List of Fields in the Raw Agent Data
Field
Description
Data type
Unit
Measurement type
Example
SessionGUID
Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String
Snapshot
00000002-f295-9109-e7c7-c964011dd401
SessionID
Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number
Snapshot
3
User
User name
String
Snapshot
Domain\JohnDoe
SessionLogoffTime
Time when the user logged of
String
Snapshot
2018-07-23 10:06:02
SessionEndTime
Time when the session ended
String
Snapshot
2018-07-23 10:08:02
SessionDurationMs
Session duration
Number
ms
Sum
25000
ProfileUnloadTimeMs2
User profile unloading time
Number
ms
Sum
300
GroupPolicyLogoffScriptTimeMs
Group Policy logoff script processing time
Number
ms
Sum
358
TotalLogoffTimeMs
Logoff duration combined for all phases
Number
ms
Sum
40000
ProcessStartCount
Number of processes started
Number
Count
8
IOCountRead
Count of read I/O operations
Number
Count
100
IOCountWrite
Count of write I/O operations
Number
Count
100
IOMBRead
Amount of read data volume
Number
MB
Sum
50
IOMBWrite
Amount of write data volume
Number
MB
Sum
50
IOLatencyReadMs
I/O read operation duration divided by count of read I/O operations
Number
ms
Average
358
IOLatencyWriteMs
I/O write operation duration divided by count of write I/O operations
Number
ms
Average
358
Logoff processes
Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path and CPU footprint.
Details
Source type: uberAgent:Process:LogoffProcesses
Used in dashboards: Single Logoff
Enabled through configuration setting: LogonProcesses
Related configuration settings: n/a
List of Fields in the Raw Agent Data
Field
Description
Data type
Unit
Measurement type
Example
ProcName
Process name
String
Snapshot
chrome.exe
ProcID
Process ID
Number
Snapshot
456
ProcParentName
Parent process name
String
Snapshot
PowerShell.exe
ProcParentID
Parent process ID
Number
Snapshot
789
ProcUser
User who ran the process
String
Snapshot
Domain\JohnDoe
AppId
Associated application ID. Used by uberAgent to lookup application names and populate field AppName.
String
Snapshot
GglChrm
AppVersion
Associated application version
String
Snapshot
67.0.3396.99
LogoffProcType
uberAgent groups processes running during logon into types. Possible values: Other, GP logoff script, Session teardown
User Logoff Metrics
In this article
Logoff Detail
uberAgent collects various details about logoffs like profile unload time, Group Policy logoff script time as well as process performance.
Details
uberAgent:Logoff:LogoffDetail
LogonDetail
List of Fields in the Raw Agent Data
Valid for this session only.
Will be reassigned to other sessions after logoff.
Logoff processes
Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path and CPU footprint.
Details
uberAgent:Process:LogoffProcesses
LogonProcesses
List of Fields in the Raw Agent Data
AppName
.Other
,GP logoff script
,Session teardown
Valid for this session only.
Will be reassigned to other sessions after logoff.
List of Calculated Fields