3

I have about a dozen servers, and I am looking to quickly find out all of the login/logout times, for a subset of users, for all servers, during January.

Is there a quick, easy way to get this information (faster and easier than manually combing through the security logs)?

I would rather not replicate any work - are there any publicly posted tools or scripts that already implement a solution to this problem?

2 Answers 2

1

There are a number of ways to do this, all involving the application of filters to the logs, which you can also do using the event log viewer.

There are many scripted solutions for this, or you can create your own in just about any language. I use Perl to process the logs each night, grabbing just the entries for the last 24 hours, and export the desired data to a MySQL database, from which I create reports using Access.

2
  • I'd rather not replicate work if I can help it - are there any publicly available tools or open source scripts already written, that I can use for this purpose? Mar 8, 2010 at 15:45
  • You can find a script that I used as the basis for my version at gardeniers.com/files/SecurityLogs.zip. It started life as something I found elsewhere quite a few years ago and doesn't do the logoffs, although that's readily added, and I do apologise for the complete lack of comments. Mar 8, 2010 at 21:22
0

You can do a simple Event Log dump with powershell:

get-eventlog -LogName Security | convertTo-csv > C:\SecurityLogAudit.csv

Then open the csv in excel, parse the events you want to look for, and then graph away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .