Jul 29 2021
- last edited on
Apr 08 2022
I currently have the log analytics agent installed on our on prem servers (RDS farm).
I was hoping I could create a query that would display - user and server logged on to. Logged on since what time and if the session is disconnected or active.
WVD has the following
// Session duration
// Lists users by session duration in the last 24 hours.
// The "State" provides information on the connection stage of an actitivity.
// The delta between "Connected" and "Completed" provides the connection time for a specific connection.
| where TimeGenerated > ago(24h)
| where State == "Connected"
| project CorrelationId , UserName, ConnectionType , StartTime=TimeGenerated
| join (WVDConnections
| where State == "Completed"
| project EndTime=TimeGenerated, CorrelationId)
| project Duration = EndTime - StartTime, ConnectionType, UserName
| sort by Duration desc
Is there something similar for RDS on prem? Where would be the best place to start looking?
Aug 26 2021 10:24 AM