Forum Discussion

itskvad's avatar
itskvad
Copper Contributor
Jul 29, 2021

Log analytics on prem RDS query for current logged on users

 

I currently have the log analytics agent installed on our on prem servers (RDS farm).

 

I was hoping I could create a query that would display - user and server logged on to. Logged on since what time and if the session is disconnected or active.

 

 

WVD has the following

// Session duration

// Lists users by session duration in the last 24 hours.

// The "State" provides information on the connection stage of an actitivity.

// The delta between "Connected" and "Completed" provides the connection time for a specific connection.

WVDConnections

| where TimeGenerated > ago(24h)

| where State == "Connected" 

| project CorrelationId , UserName, ConnectionType , StartTime=TimeGenerated 

| join (WVDConnections 

    | where State == "Completed" 

    | project EndTime=TimeGenerated, CorrelationId) 

    on CorrelationId 

| project Duration = EndTime - StartTime, ConnectionType, UserName 

| sort by Duration desc

 

 

Is there something similar for RDS on prem? Where would be the best place to start looking?

 

Thanks

Resources