Share via

SCOM: Calculate the User Session duration with PowerShell

  • Article

Introduction

How many users are connecting to SCOM daily/weekly and how long was each user connected?

Out-of-the-box SCOM does not provide you a way of doing this.

This article provided a start, which looked pretty convincing

https://blogs.technet.microsoft.com/dirkbri/2014/10/15/an-approach-of-collecting-and-analyzing-scom-2012-sdk-connections/

This looked all good, except we wanted to do it with Powershell

Whenever any “client” connects/disconnects to/from the console an event is written in the Operations Manager event log.

In each event there is event data which gives you information on the following points:

  • EventID
  • ManagementServer Name
  • Username
  • SessionID
  • UUID – extracted from SessionID
  • ID – extracted from SessionID
  • TimeCreated
  • SessionDuration -calculated Time between log on and log off Event
  • SessionCount – calculated cumulated counter of all current sessions

Some important remarks which apply to both methods (the one described in the blog and the script).

Remarks

Number of open and closed sessions

If you create daily files, you will have an unknown amount of already open sessions at the beginning of the day and a certain amount of not yet closed sessions at the end. So your SessionCount will be lower than the cumulated values from the “Client Connections” performance counters of all Management Servers

But when you analyse e.g. weekly data instead of daily, you should get very good results

PowerShell SDK connections and Operations console connections.

The tricky part is, the exact same event is written when a Powershell SDK connection is made. You cannot distinguish between PowerShell SDK connections and Operations console connections. Unfortunately this is by design...

The script parses all the events, which are being logged in regards to the particular user and gathers information in regards to:

  • Open session, where the session has not been closed (presence of the Login event, absence of Logout event)
  • Closed session and their duration (presence of the Login event and Logout event)
  • Closed session without and Login session event, indicating that the Login session event has been overridden and cannot be found.
  • The script should be run directly on a management server. If you need you can enable PSremoting and run this on a multiple management server.
  • The script is in its first version, where you need to enter a domain and username. The second version (currently being worked on) will include a full report on all user session and their duration, without the need of specifying a particular user name.

Download

You can download the script here:

https://gallery.technet.microsoft.com/Calculate-the-SCOM-User-6743a3b6