User Logoff Metrics
Logoff Detail
uberAgent collects various details about logoffs like profile unload time, Group Policy logoff script time as well as process performance.
Details
- Source type:
uberAgent:Logoff:LogoffDetail
- Used in dashboards: User Logoff Duration, Single Logoff
- Enabled through configuration setting:
LogonDetail
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
Field | Description | Data type | Unit | Measurement type | Example |
---|---|---|---|---|---|
SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | Snapshot | 00000002-f295-9109-e7c7-c964011dd401 | |
SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | Snapshot | 3 | |
User | User name. | String | Snapshot | Domain\JohnDoe | |
SessionLogoffTime | Time when the user logged off. | String | Snapshot | 2018-07-23 10:06:02 | |
SessionEndTime | Time when the session ended. | String | Snapshot | 2018-07-23 10:08:02 | |
SessionDurationMs | Session duration. | Number | ms | Sum | 25000 |
ProfileUnloadTimeMs2 | User profile unloading time. | Number | ms | Sum | 300 |
GroupPolicyLogoffScriptTimeMs | Group Policy logoff script processing time. | Number | ms | Sum | 358 |
TotalLogoffTimeMs | Logoff duration combined for all phases. | Number | ms | Sum | 40000 |
ProcessStartCount | Number of processes started. | Number | Count | 8 | |
IOCountRead | Count of read I/O operations. | Number | Count | 100 | |
IOCountWrite | Count of write I/O operations. | Number | Count | 100 | |
IOMBRead | Amount of read data volume. | Number | MB | Sum | 50 |
IOMBWrite | Amount of write data volume. | Number | MB | Sum | 50 |
IOLatencyReadMs | I/O read operation duration divided by count of read I/O operations. | Number | ms | Average | 358 |
IOLatencyWriteMs | I/O write operation duration divided by count of write I/O operations. | Number | ms | Average | 358 |
Logoff processes
Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path, and CPU footprint.
Details
- Source type:
uberAgent:Process:LogoffProcesses
- Used in dashboards: Single Logoff
- Enabled through configuration setting:
LogonProcesses
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
Field | Description | Data type | Unit | Measurement type | Example |
---|---|---|---|---|---|
ProcName | Process name. | String | Snapshot | chrome.exe | |
ProcID | Process ID. | Number | Snapshot | 456 | |
ProcParentName | Parent process name. | String | Snapshot | PowerShell.exe | |
ProcParentID | Parent process ID. | Number | Snapshot | 789 | |
ProcUser | User who ran the process. | String | Snapshot | Domain\JohnDoe | |
AppId | Associated application ID. Used by uberAgent to lookup application names and populate field AppName . |
String | Snapshot | GglChrm | |
AppVersion | Associated application version. | String | Snapshot | 67.0.3396.99 | |
LogoffProcType | uberAgent groups processes running during logon into types. Possible values: Other , GP logoff script , Session teardown . |
String | Snapshot | Other | |
ProcStartTimeRelativeMs | Process relative start time. | Number | ms | Snapshot | 16764 |
ProcLifetimeMs | Process lifetime. | Number | ms | Sum | 73615 |
ProcCmdline | Process command line. | String | Snapshot | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe –url http://vastlimits.com | |
ProcPath | Process path. | String | Snapshot | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | |
ProcIOReadCount | Process I/O operation read count. | Number | Count | 2000 | |
ProcIOWriteCount | Process I/O operation write count. | Number | Count | 990 | |
ProcIOReadMB | Process I/O operation read data volume. | Number | MB | Sum | 100.05 |
ProcIOWriteMB | Process I/O operation write data volume. | Number | MB | Sum | 16.06 |
ProcIOLatencyReadMs2 | Process I/O operation read latency. | Number | ms | Average | 300 |
ProcIOLatencyWriteMs2 | Process I/O operation write latency. | Number | ms | Average | 300 |
ProcNetKBPS | Process generated network traffic. | Number | KB | Sum | 19.18 |
SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | Snapshot | 00000002-f295-9109-e7c7-c964011dd401 | |
SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | Snapshot | 3 | |
TotalLogoffDurationMs | Total logoff duration. | Number | ms | Sum | 40000 |
SortOrder2 | Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. | Number | Snapshot | 29 |
List of Calculated Fields
Field | Description | Data type | Unit | Measurement type | Where available | Example |
---|---|---|---|---|---|---|
AppName | Associated application name. | String | Snapshot | Splunk data model, Splunk SPL | Google Chrome | |
SortOrder | Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. | Number | Snapshot | Splunk data model | 29 |