locked
Missing Logon Entrees in Security Events Log RRS feed

  • Question

  • Hi Everyone,
    I was told to cross post this here.  I will preface this question by stating that I'm a Linux user, so I'm by no means a Windows expert.  I apologize if this question is trivial, but I haven't been able to find a similar problem or solution out there.
    Basically, we have several instrument computers in our department for which we use the Security Events log to tabulate usage on the instrument for billing individual faculty.  I've written some custom BASH scripts in Linux that take the logs, parse out the relevant information, calculate the hourly charges based on the time of day and then spit out a csv report with the charges for the month.  This works very well on two of the instruments.  However, on the third instrument computer, there are at least 5-10 logons per month in which either the logon or logoff is missing from the events log.  I've written the script to removing these hanging logons, but it's obviously a problem as we're missing multiple sessions per month and undercharging the users (it does warn for beginning and end open logins so that we can check the previous or subsequent months for sessions that span the end of one month and the beginning of the next).  Has anyone else run into this issue before?  It seems weird that the other two computers don't have a problem at all.  Any help would be greatly appreciated!
    Thanks!
    Rob
    Friday, August 30, 2013 6:25 PM

All replies

  • The configurations for PCs might be different, check Audit Mode for login and see if it is on for those PCs or not?

    Saturday, September 28, 2013 7:14 AM