We're running a certain application on a client's server. The app runs on the console session, and basically manages some batch processing. Every once in a while we discover the app is not running, and obviously this only happens after the client complains about the app's job not getting done. The reasons for the app's shutdown vary from internal error to deliberate shutdown to server restart. If the latter, I can see the evidence in the event viewer. On the other cases, I'm looking for a way to discover who was logged on at the time the app was shut down.
What seems reasonable to me is running the app via a batch file, and once the app is closed the batch commands that will follow will list the currently logged on users, one of which probably responsible for the shutdown. The problem is everyone logs into the server using the network admin credentials(!), and different sessions can be told apart only by the user's machine name.
It is worth mentioning that:
- The app does a classic service job, but it can't be converted to one.
- I tried some Sysinternal tools, but none listed the info I needed.
- I'd rather not use the event viewer. It's swamped as it is. Log files are better.
- I'm not trying to get legal evidence, just figure out what happens before the app exits.
- I'm a programmer, not a sysadmin. Please bare with me...