Product documentation
uberAgent
Current Release (7.3.0) 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0
View PDF

Logon Data Arrives Late or Never in the Backend

July 19, 2024
Contributed by: 
C

Symptoms

  • Logon data for a user session is not available in Splunk immediately. Instead, it arrives after the user logged off.
  • Logon data for a user session is not available in Splunk at all.

Cause

The cause is similar to "GP logon script" is longer than "Total duration" and how uberAgent determines the GP logon script phase.

For uberAgent, the phase starts with the process start gpscript.exe /logon. The phase ends when all recursive children of that process are stopped. So, if you have a main logon script that starts other scripts or processes and these continue to run, uberAgent waits for these to stop.

Two situations make uberAgent stop monitoring the logon:

  1. Logoff: the user logs off, which effectively stops all processes in the session, including the ones from your logon script. uberAgent stops the logon monitoring and sends the data to the backend. This typically results in high values for the phase GP logon script.
  2. Logon timeout expires: after 30 minutes, uberAgent stops monitoring the logon. No data about the logon is sent.
Logon Data Arrives Late or Never in the Backend
July 19, 2024
Contributed by: 
C
July 19, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.