As I've undestood you're going to track who was lodded in/out into
console...
Here is an Robert Duncanson's answer on this question some months ago:
The only thing stored in the database is the audit trail, but not actual
sessions. You might be able to query the audit trail like this:
SELECT
ADT.AuditTrailID, ADT.AuditTime, ADT.Username, ADC.EventDesc,
ADI.ParamName, ADI.ParamValue
from AuditTrail as ADT
JOIN AuditInfo as ADI
on ADT.AuditTrailID = ADI.AuditTrailID
JOIN AuditEventCMD as ADC
on ADT.AuditEventCMDID = ADC.AuditEventCMDID
-- AuditEventCMDID 5 = console login, 6 = console logout
WHERE ADT.AuditEventCMDID IN (5, 6)
Hope, this is what you need. Good luck.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50
tel +7 095 777 77 07 (1613)
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
> Sent: Tuesday, May 31, 2005 5:45 PM
> To: Tim Beatty
> Cc: [email protected]
> Subject: Re: [ISSForum] SiteProtector user login auditing
>
>
>
> You could do a port scan (netstat, tcpview, et. al) on the
> management server and see what connections to port 3998 are
> open, Not sure this is what you were looking for, but might
> be helpful to know who is logged in to a SP session.
>
> dcj2
>
>
>
>
>
> To: [email protected]
> cc: (bcc: Doug Janelle/Inc/Jouan)
> Subject: [ISSForum] SiteProtector user login auditing
>
>
> Is it possible to trace user logins to SiteProtector?
>
> Thank-you,
> Tim Beatty
>
>
> _______________________________________________
> ISSForum mailing list
> [email protected]
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
>
> The ISSForum mailing list is hosted and managed by Internet
> Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
