A connect member was requesting a report that would show logon/logoff events over a given date range and between given times.
Attached it a report that allows you to specify a date range and a time range to show logon/logoff events for managed resources.
To use this report, you will need to import it. Navigate to the reports tab in the Altiris Console, right-click on the folder where you want the report located and select "Import". Browse to the folder where you downloaded the this report and select it.
Once imported, select "Run this Report".
You will be prompted to input your variables:
If you wanted to see the events for July 14th, you would enter 07/14/2009 in both the start and end date fields. If you only wanted to see the events on that day between 2:00 PM and 4:00 PM you would enter 14:00 for the start time and 16:00 for the ending time.
You can also see the time frame narrowed over a multiple date range. For instance, setting the start time to 14:00 and the end time to 18:00 and setting the start date to 07/06/2009 and the end date to 07/10/2009 will give you all the events that occurred between 2:00PM and 6:00PM on each of those days.
Any questions or updates, please feel free to PM me.
I have built a version 7 report a couple of things need improvement but one thing to note I don't know how to attached the xml export to this forum post.
Minor improvements could be made:
1. Report Parameters - For some reason even though I have changed the "Display/Eval Order" it does not affect the order of display of these to my user. They are alphabetically ordered and I can't figure out how to change this. Not a big deal but the order is:
Computer Name:
End Date:
Start Date:
User Name:
Would be nice to put switch the End and Start dates.
2. Add in security scoping
3. Currently it allows me to define date and time but I would like the default end time to always be 23:59 not sure how to set this to default this way.
Has anyone converted this report to a NS7 report when I imported it I got complaints that it needed to be upgraded. The SQL posted above works just fine in my db.
I seemed to not be getting any results from any recent months, what triggers entry to the [Evt_AeX_Client_LogOn] table? ie which module in CMS. We used the Carbon Copy log on tables for a bit, but those were unreliable as it tended to give false readings when the service was started/stopped. PS the report would be much better with two extra filters; by 'user' and by 'computer'...gives it a much better "who has been where" feel. I'm sorry, i'm rubbish at SQL so ours arent worth uploading.