{"id":3514,"date":"2013-03-09T22:25:10","date_gmt":"2013-03-09T21:25:10","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=3514"},"modified":"2013-03-09T22:25:10","modified_gmt":"2013-03-09T21:25:10","slug":"tracking-logon-and-logoff-activities-in-service-manager","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=3514","title":{"rendered":"Tracking Logon and Logoff Activities in Service Manager"},"content":{"rendered":"

Last week I\u00c2\u00a0received\u00c2\u00a0a e-mail around tracking logon<\/span> and logoff<\/span> activities Service Manager\u00c2\u00a0with Operations Manager. It can be solved with a event collection rule and the default custom event report.<\/span><\/p>\n

    \n
  1. In Operations Manager console, navigate to the Authoring\u00c2\u00a0work space\u00c2\u00a0and Rules<\/span><\/li>\n
  2. Create a new rule of type Collection Rules\/Event Based\/NT Event Log<\/li>\n
  3. Select a suitable management pack or create a new management pack, Next<\/li>\n
  4. Input a rule name, for example Contoso<\/span> – Service Manager – Logon<\/span> and Logoff<\/span><\/span><\/li>\n
  5. Select a rule target. If you have the Service Manager management pack imported you can use the SCSM 2012 Management Server class as target. Logon<\/span> and Logoff<\/span> events will be generated on your Service Manager management servers. Next<\/span><\/li>\n
  6. Event Log Type, select or input Operations Manager, Next<\/li>\n
  7. Build Event Expression like in the figure below, then save the new rule. In the example I exclude all events about my service accounts, all\u00c2\u00a0service\u00c2\u00a0accounts starts with svc<\/span>. \u00c2\u00a0Event ID 26328 is logon<\/span> and event id 26329 is logoff<\/span>.<\/span><\/li>\n<\/ol>\n

    \"20130309_SCSM01\"<\/a><\/p>\n

     <\/p>\n

    Once the rule is created and deployed to your Service Manager management servers they will start report back events as soon as someone logon<\/span> or logoff<\/span> Service Manager. You can create a event view in the same management pack and configure the event view to show events generated by your new rule.<\/span><\/p>\n

     <\/p>\n

    \"20130309_SCSM02\"<\/a><\/p>\n

    To show this data in a report you can use the default Reporting, Microsoft Generic Report Library, Custom Event report. The following figure show configuration of the Custom Event report<\/p>\n

    \"20130309_SCSM03\"<\/a><\/p>\n

     <\/p>\n

    and the result of the report<\/p>\n

    \"20130309_SCSM04\"<\/a><\/p>\n

     <\/p>\n

     <\/p>\n

    If you want to look at the events in the Operations Manager data warehouse database you can use the following SQL query<\/p>\n

    select * from Event.vEvent<\/span> ev<\/span><\/span>
    \n inner join Event.vEventDetail<\/span> evd<\/span> on ev<\/span>.eventoriginid<\/span> = evd<\/span>.eventoriginid<\/span><\/span>
    \n inner join Event.vEventParameter<\/span> evp<\/span> on ev<\/span>.eventoriginid<\/span> = evp<\/span>.eventoriginid<\/span><\/span>
    \n where eventdisplaynumber<\/span> = ‘26329’ OR eventdisplaynumber<\/span> = ‘26328’<\/span><\/p><\/blockquote>\n

    If you want to build your own report you can use SQL Report Builder. I have a example of that here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Last week I\u00c2\u00a0received\u00c2\u00a0a e-mail around tracking logon and logoff activities Service Manager\u00c2\u00a0with Operations Manager. It can be solved with a event collection rule and the default custom event report. In Operations Manager console, navigate to the Authoring\u00c2\u00a0work space\u00c2\u00a0and Rules Create a new rule of type Collection Rules\/Event Based\/NT Event Log Select a suitable management pack … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[61,25],"tags":[],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3514"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3514"}],"version-history":[{"count":4,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3514\/revisions"}],"predecessor-version":[{"id":3522,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3514\/revisions\/3522"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3514"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}