Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Log & Event Manager (LEM) > Create a custom report to show only interactive user logon events

Create a custom report to show only interactive user logon events

Table of contents
Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 343 Votes: 2 Revisions: 4

Overview

This article describes how to create a custom Authentication - User Log On or Authentication - User Log On by User report that filters out everything but actual interactive logon events (physical logons).

Environment

All LEM versions

Steps

  1. Open your Reports Console and run an Authentication - User Log On or Authentication - User Log On by User report for the last 24 hours.
  2. Click on the Select Expert button and click New.
  3. Select the last field, USERLOGON_1.LOGONTYPE, and click OK.
  4. Change the drop down box to is equal to and change the second drop down box to Windows: Interactive and click OK. This will filter the report to show only interactive logon events.
  5. Click the Export button and change the Format to Crystal Reports (RPT). Save it to the CustomReports folder under your SolarWinds Log and Event Manager Reports installation folder.
  6. You can now press F5 to refresh your reports list and see your saved report by going to the Settings tab and changing the Category to Custom Reports.

 

 

 

Last modified
19:57, 22 Jun 2016

Tags

Classifications

Public