Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: sonoracomm on February 25, 2005, 10:57:01 PM

Title: Logging or Auditing Users as they Logon and Logoff
Post by: sonoracomm on February 25, 2005, 10:57:01 PM: Does anyone have a good method to log users' network activity?

Specifically, we want to use this info with, or in liu of a punch clock. The owner wants an easy way to track when users logon and logout of the network. Most clients are Windows 2000 Pro.

I have experimented with preexec and postexec in smb.conf, but it looks like Windows is very unpredictable about when it accesses and releases a share. I've experimented with various shares without useful results.

I experimented a bit with the utmp option and the 'last' command. That seemed a bit more useful except for two problems. How to set the deadtime option (it is 10080 by default) and how to parse or use the utmp info. Why is the deadtime set to 10080? (I don't want to break something.)

I would welcome any comments as to the best way to 'get there from here'.

Thanks in advance,

G
Title: Logging or Auditing Users as they Logon and Logoff
Post by: matsk on February 25, 2005, 11:45:44 PM: The posting moved by the author to:
http://sme.4gurus.org/modules/newbb/viewforum.php?forum=3
Title: Logging or Auditing Users as they Logon and Logoff
Post by: sonoracomm on February 27, 2005, 06:25:09 PM: That's surely a reasonable idea...

However, it only helps with logons, not logoffs. It's the logoff part that really seems hard.

Thanks much,

G
Title: Logging or Auditing Users as they Logon and Logoff
Post by: matsk on February 27, 2005, 08:25:37 PM: The posting moved by the author to:
http://sme.4gurus.org/modules/newbb/viewforum.php?forum=3
Title: Logging or Auditing Users as they Logon and Logoff
Post by: Franco on August 15, 2005, 05:53:43 AM: What was the end result of this thread? I'm looking for the exact same thing!
Anyone have any ideas on how should I implement ways to track users login in and out?

Thanks,
Title: Logging or Auditing Users as they Logon and Logoff
Post by: sonoracomm on August 17, 2005, 07:50:00 PM: I gave up. I still need this.

It seems that the log IN part is easy. However Windows seems to somewhat arbitrarily log in and logout whenever it wants during the session.

G
Title: Logging or Auditing Users as they Logon and Logoff
Post by: CharlieBrady on August 17, 2005, 11:23:18 PM: Quote from: "sonoracomm"
That's surely a reasonable idea...

Whatever the idea was. It seems the author has taken the idea away. That seems rather un-generous.
Title: Logging or Auditing Users as they Logon and Logoff
Post by: CharlieBrady on August 17, 2005, 11:24:56 PM: Quote from: "sonoracomm"

However Windows seems to somewhat arbitrarily log in and logout whenever it wants during the session.

AIUI, that's part of the definition of the SMB protocol. Sessions are re-established as required.
Title: Logging or Auditing Users as they Logon and Logoff
Post by: sonoracomm on August 18, 2005, 09:53:40 PM: One thing I seem to remember about this, and I may be wrong, is that MS had added a new capability to XP (SP2?) where you can control logoff behavior, maybe using a GPO.

Unfortunately, this didn't help me much because the vast majority of my customers have followed my advice to use Windows 2000 Pro instead of XP Pro.

I would still love a solution to this though...

G
Title: Logging or Auditing Users as they Logon and Logoff
Post by: Franco on August 20, 2005, 05:20:49 PM: I'm looking at some options and as soon as I come up with something I'll be glad to share. I'm on the same boat where older systems need to apply!