Documentation

Contents
Contents
Contents
Contents

User Logoff Metrics

Group Policy Logoff Script Time

uberAgent collects the duration of the Group Policy logoff script.

Details

  • Source type: uberAgent:Logoff:GroupPolicyLogoffScriptTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String Snapshot 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number Snapshot 3
User User name String Snapshot Domain\JohnDoe
GroupPolicyLogoffScriptTimeMs Group Policy logoff script processing time Number ms Sum 358

Logoff performance

uberAgent collects logoff performance information like disk footprint and process start count.

Details

  • Source type: uberAgent:Logoff:LogoffPerformance
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
ProcessStartCount Number of processes started Number Count 8
IOCountRead Count of read I/O operations Number Count 100
IOCountWrite Count of write I/O operations Number Count 100
IOMBRead Amount of read data volume Number MB Sum 50
IOMBWrite Amount of write data volume Number MB Sum 50
IOLatencyReadMs I/O read operation duration divided by count of read I/O operations Number ms Average 358
IOLatencyWriteMs I/O write operation duration divided by count of write I/O operations Number ms Average 358

Logoff processes

Detailed performance data about all processes active during user logoff like process start time and lifetime duration, commandline, executable path and CPU footprint.

Details

  • Source type: uberAgent:Process:LogoffProcesses
  • Used in dashboards: Single Logoff
  • Enabled through configuration setting: LogonProcesses
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
ProcName Process name String Snapshot chrome.exe
ProcID Process ID Number Snapshot 456
ProcParentName Parent process name String Snapshot PowerShell.exe
ProcParentID Parent process ID Number Snapshot 789
ProcUser User who ran the process String Snapshot Domain\JohnDoe
AppId Associated application ID. Used by uberAgent to lookup application names and populate field AppName. String Snapshot GglChrm
AppVersion Associated application version String Snapshot 67.0.3396.99
LogoffProcType uberAgent groups processes running during logon into types. Possible values: Other, GP logoff script, Session teardown String Snapshot Other
ProcStartTimeRelativeMs Process relative start time Number ms Snapshot 16764
ProcLifetimeMs Process lifetime Number ms Sum 73615
ProcCmdline Process command line String Snapshot C:\Program Files (x86)\Google\Chrome\Application\chrome.exe –url http://vastlimits.com
ProcPath Process path String Snapshot C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
ProcIOReadCount Process I/O operation read count Number Count 2000
ProcIOWriteCount Process I/O operation write count Number Count 990
ProcIOReadMB Process I/O operation read data volume Number MB Sum 100.05
ProcIOWriteMB Process I/O operation write data volume Number MB Sum 16.06
ProcIOLatencyReadMs Process I/O operation read latency String ms Average 300
ProcIOLatencyWriteMs Process I/O operation write latency String ms Average 300
ProcNetKBPS Process generated network traffic Number KB Sum 19.18
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String Snapshot 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number Snapshot 3
TotalLogoffDurationMs Total logoff duration Number ms Sum 40000
SortOrder Sort order number to sort the table Logoff process performance on the Single Logoff dashboard correctly. Number Snapshot 29

List of Calculated Fields

Field Description Data type Unit Measurement type Where available Example
AppName Associated application name String Snapshot Splunk data model, Splunk SPL Google Chrome

Profile Unload Time

uberAgent collects the duration of user profile unloading

Details

  • Source type: uberAgent:Logoff:ProfileUnloadTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String Snapshot 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number Snapshot 3
User User name String Snapshot Domain\JohnDoe
ProfileUnloadTimeMs User profile unloading time Number ms Sum 300

Session Logoff

uberAgent collects information about session logoff like session logoff time.

Details

  • Source type: uberAgent:Logoff:SessionLogoffTime
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String Snapshot 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number Snapshot 3
User User name String Snapshot Domain\JohnDoe
SessionLogoffTime Time when the user logged of String Snapshot 2018-07-23 10:06:02

Total logoff time

uberAgent collects the total duration of every logoff.

Details

  • Source type: uberAgent:Logoff:TotalLogoffTimeMs
  • Used in dashboards: User Logoff Duration, Single Logoff
  • Enabled through configuration setting: LogonDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Measurement type Example
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String Snapshot 00000002-f295-9109-e7c7-c964011dd401
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number Snapshot 3
User User name String Snapshot Domain\JohnDoe
TotalLogoffTimeMs Logoff duration combined for all phases Number ms Sum 40000

Leave a Reply

Your email address will not be published. Required fields are marked *