Search for all logon and logoff activity for a specific host in SEM

This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides steps on how to search for all logon and logoff activity for one particular host.

1. On the SEM console menu bar, navigate to Explore > nDepth, and then click Search Builder which can be found in the rightmost icon on the nDepth toolbar.

   

2. Create a query as shown in the following image:

   

   Note: To find the correct values, expand the Events list, and then type userlogo.