Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have about a dozen servers, and I am looking to quickly find out all of the login/logout times, for a subset of users, for all servers, during January.

Is there a quick, easy way to get this information (faster and easier than manually combing through the security logs)?

I would rather not replicate any work - are there any publicly posted tools or scripts that already implement a solution to this problem?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

There are a number of ways to do this, all involving the application of filters to the logs, which you can also do using the event log viewer.

There are many scripted solutions for this, or you can create your own in just about any language. I use Perl to process the logs each night, grabbing just the entries for the last 24 hours, and export the desired data to a MySQL database, from which I create reports using Access.

share|improve this answer
    
I'd rather not replicate work if I can help it - are there any publicly available tools or open source scripts already written, that I can use for this purpose? –  blueberryfields Mar 8 '10 at 15:45
    
You can find a script that I used as the basis for my version at gardeniers.com/files/SecurityLogs.zip. It started life as something I found elsewhere quite a few years ago and doesn't do the logoffs, although that's readily added, and I do apologise for the complete lack of comments. –  John Gardeniers Mar 8 '10 at 21:22

You can do a simple Event Log dump with powershell:

get-eventlog -LogName Security | convertTo-csv > C:\SecurityLogAudit.csv

Then open the csv in excel, parse the events you want to look for, and then graph away.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.