The Logon Monitor Server Edition Control Panel Applet - CSV Log Settings Tab

Comma-Separated values (CSV) Files

Enabled
When this box is checked, Logon Monitor Server Edition will record logon/logoff activty to two distinct CSV files - the Events log and the Sessions log. By default, the CSV log files are located in C:\Program Files\Greyware Logon Monitor\ folder and are named EVENTS.CSV and SESSIONS.CSV, respectively.

The location of these files can be changed by editing the Filename (events) and Filename (sessions) values in the HKLM\Software\Greyware\Greyware Logon Monitor\Log\CSV\ registry key.

User Logons - When checked, Logon Monitor Server Edition will record user logon events.

User Logoffs - When checked, Logon Monitor Server Edition will record user logoff events.

User Active/Idle Status - These events indicate when a logged-in user's session changes from Active to Idle (for example, when their screen saver kicks in).

Service Startups - When checked, and entry will be made when the Logon Monitor Server Edition service starts.

Service Startups - When checked, and entry will be made when the Logon Monitor Server Edition service stops.

Completed Session Summaries - Checking this box will cause a summary entry to be entered in the log when a user's login session ends. The summary will include information such as how long the user was logged in, how long the session was in Idle status, etc.

The Events log keeps a accumulating record of the "raw data" collected by the service. You can use this file to see all of the events the service generates. No attempt is made to analyze or group the data. This allows you to create your own reports or mine the data in any way that meets your needs.

By contrast, the Sessions log is a "roll-up" log that attempts to match up logon events with their corresponding logoffs to be able to determine how long a particular user was logged in. A logon event matched with a corresponding logoff event is considered a "session." If this button is selected, the text log will only record events that occur on the local machine. Any incoming data records from other Logon Monitor machines will be not be included (note that incoming events may still be collected into one of the other log types, such as CSV, database, or Event Viewer). This allows you to individually determine which of the log types will collect what kind of information (and from where).

Events from this machine and any machine reporting to this machine
If this button is selected, the text log will record all events originating on the local machine, and also include any data records reported to the service from other machines running Logon Monitor.

Record events using this machine's local time zone - Check this box if you want the timestamp on events in the log to be recorded in the time zone that is set on the local machine. If the box is unchecked, events will be stamped with the UTC time.

Events and Sessions

---

The Events log keeps an accumulating record of the "raw data" collected by the service. You can use this file to see all of the events the service generates. No attempt is made to analyze or group the data. This allows you to create your own reports or mine the data in any way that meets your needs.

By contrast, the Sessions log is a "roll-up" log that attempts to match up logon events with their corresponding logoffs to be able to determine how long a particular user was logged in. The period a user is logged in is called a "session."

Logon Monitor Server Edition uses considerable intelligence to determine the actual duration of a particular login session. However, a login session may be rendered invalid for a number of reasons (such there being a logon event but no corresponding logoff event because the machine was switched off or lost power, for example). The Session log will make note of these unmatched events, but it may not be able to display the actual logged-in duration for that session. You should keep this limitation in mind when considering the session results.

View Events and View Sessions
Use these buttons to open the EVENTS.CSV or SESSIONS.CSV files using whatever program Windows has associated with the .csv extension (such as Excel).

Select the level of precision you want to use when calculating the total time of reported sessions. This setting only affects entries in the SESSIONS.CSV log file:


Session times reported in seconds
Session times reported in minutes
Session times reported in hours & quarter-hours
Session times reported in hours & half-hours
Session times reported in hours

Limit the growth of the CSV files
Checking this box will restrict the growth of the .CSV files to the limit you specify.

Maximum size - lines.
Determines the largest size of each CSV log determined by the number of text lines. When the maximum number of lines in the file is reached, the file will either cease recording new events or older entries will ether begin to scroll off as newer messages are added (depending on your selection using these radio buttons).

When a CSV file is full:


Stop recording events
Trim oldest events from the beginning of the file

 Proceed to the Database page

 Back to the Event Viewer page