Forum Discussion

MaTu's avatar
MaTu
Icon for Contributor rankContributor
2 months ago

How can I check who is logged into SL1

Is there a way to check who is logged into SL1 at any time?

  • Hello,

    In the System > Monitor > Audit Logs page, if you filter the Source column by the string Session, you can see what users are logged in and logged out by IP address. Any user with a "Created a Session" log entry without a subsequent "Ended a session" or "session expired" log entry would still have an active session opened.

    You can also check the System > Monitor > Access Logs page, which will show users as either Logged In or Logged Out.

    Tony Andres

    Senior Technical Support Engineer | ScienceLogic

7 Replies

  • Hello,

    In the System > Monitor > Audit Logs page, if you filter the Source column by the string Session, you can see what users are logged in and logged out by IP address. Any user with a "Created a Session" log entry without a subsequent "Ended a session" or "session expired" log entry would still have an active session opened.

    You can also check the System > Monitor > Access Logs page, which will show users as either Logged In or Logged Out.

    Tony Andres

    Senior Technical Support Engineer | ScienceLogic

  • Geo's avatar
    Geo
    Icon for Contributor rankContributor

    System > Monitor > Audit Logs will show you when someone has logged in. Filter the Message column by the string 'log'.

    However, there is no record for an account timing out, and AFAIK no way to see 'active' sessions. I'm not even sure there is a concept of an active session.

    With v12 there is the new setting System > Settings > Behaviour > User Login Session Timeout. This suggests there is a table somewhere that can see when an account last did something, but it isn't in master_access.accounts. Might be worth raising a support query.

    • SaraLeslieAdmin's avatar
      SaraLeslieAdmin
      Icon for Community Manager rankCommunity Manager

      Glad this helped! MaTu please take a minute to mark the correct solution if it resolves your question. Cheers, Sara 

  • You can check this using GraphQL as well. This query will show the account details and the last login times:

    query accountSearch {
      accounts(first:1000, order: {direction: asc, field: "id"}) {
        edges {
          node {
            id
            lastLoginTime
            contact {
              cell
              department
              firstName
              lastName
              title
            }
            organization {
              id
            }
          }
        }
      }
    }

    And the link to docs: ScienceLogic - GraphQL API Introduction.

  • MarkC's avatar
    MarkC
    Contributor II

    select * from master_access.access_log limit 5000

  • Saskia's avatar
    Saskia
    Contributor III

    In the DB Tool:

    SELECT * FROM master_access.access_log WHERE state = 1

    ORDER BY login_time DESC

    LIMIT 1000;

    Other possible states are:

    | id | description  |
    +----+--------------+
    |  0 | Logged Out   |
    |  1 | Logged In    |
    |  2 | Active       |
    |  3 | Expired      |
    |  4 | Terminated   |
    |  5 | Failed Login |