|
AUDITLOG
Auditlog generates reports of logon/logoff activity for a
MetaFrame server based
on
the Windows NT Server security event log. To use auditlog, you must
first
enable
logon/logoff accounting. You can direct the auditlog output to a
file.
Syntax
auditlog [username | session ] [/eventlog:filename] [/before:mm/dd/yy]
[/after:mm/dd/yy ] [[/write:filename] | [/detail |
/time] [/all]]
auditlog [username |
session] [/eventlog:filename] [/before:mm/dd/yy]
[/after:mm/dd/yy] [[/write:filename] | [/detail]
| [/fail
] | [
/all]]
auditlog [/clear:filename]
auditlog [/?]
Parameters
filename
The name of the eventlog output
file.
session
Specifies
the session ID for which to produce a logon/logoff report. Use
this
parameter to
examine the logon/logoff record for a particular
session.
mm/dd/yy
The month, day, and year (in
two-digit format) to limit logging.
username
Specifies a username for which to
produce a logon/logoff report. Use this
parameter to
examine the logon/logoff record for a particular user.
Options
/eventlog:filename
Specifies the name of a backup
event log to use as input to auditlog. You can back up the current log from the Event Log
Viewer by using
auditlog
/clear:filename.
/before:mm/dd/yy
Reports on logon/logoff
activity only before mm/dd/yy.
/after:mm/dd/yy
Reports on logon/logoff
activity only after mm/dd/yy.
Appendix A
MetaFrame XP Commands 319
/write:filename
Specifies the name of an
output file. Creates a comma-delimited file that can be
imported into an application, such as a spreadsheet, to produce custom
reports or statistics. It generates a report of
logon/logoff activity for each user, displaying
logon/logoff times and total time logged on. If filename
exists, the data is appended to the
file.
/time
Generates a
report of logon/logoff activity for each user,
displaying
logon/logoff
times and total time logged on. Useful for gathering
usage
statistics by
user.
/fail
Generates a
report of all failed logon attempts.
/all
Generates a
report of all logon/logoff activity.
/detail
Generates a
detailed report of logon/logoff activity.
/clear:filename
Saves the current event log in
filename
and
clears the event log. This
command
does not work if filename
already exists.
/?
Displays the syntax for the utility and information about the
utility’s options.
|
