Product documentation
uberAgent
Select version Current Release 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0

Logon Data Arrives Late or Never in the Backend

July 9, 2024
Contributed by: 
C

Symptoms

  • Logon data for a user session is not available in Splunk immediately. Instead, it arrives after the user logged off.
  • Logon data for a user session is not available in Splunk at all.

Cause

The cause is similar to "GP logon script" is longer than "Total duration" and how uberAgent determines the GP logon script phase.

For uberAgent, the phase starts with the process start gpscript.exe /logon. The phase ends when all recursive children of that process are stopped. So, if you have a main logon script that starts other scripts or processes and these continue to run, uberAgent waits for these to stop.

Two situations make uberAgent stop monitoring the logon:

  1. Logoff: the user logs off, which effectively stops all processes in the session, including the ones from your logon script. uberAgent stops the logon monitoring and sends the data to the backend. This typically results in high values for the phase GP logon script.
  2. Logon timeout expires: after 30 minutes, uberAgent stops monitoring the logon. No data about the logon is sent.
Logon Data Arrives Late or Never in the Backend
July 9, 2024
Contributed by: 
C
July 9, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.