Monitoring Logoff/Logon Events for Anomalies
Background - We have a fairly large citrix environment(70 customers, 1200 users). Each customer has 1 or more xenapp servers depending on how many users. The environment is setup in a manner that often times the first step in troubleshooting is having the users logon/log off(which obviously creates an event id). We would like to plot the number of logon/logoffs(via event ids) per every 10 minute period and look for anomalies(periods of high logons/logoffs relative to normal or relative to number of users in environment). First step for us is simply plotting the data. Any ideas ideas on the best way to approach this problem. My initial thought is simply to write a powershell script to search for the eventids over the 10 minutes and return the number...then apply this to each xenapp server in logicmonitor but maybe there is a better approach? I also don't know the best approach to aggregate by customer or even factor in the number of users...assuming we would need to export to excel to handle some of that. Ideas welcomed.
Sure... I'm using this as a datasource targeting isWindows() called "Active Directory Failed Login Count"
try { $events = Get-WinEvent ` -ComputerName ##system.sysname## ` -ErrorAction SilentlyContinue ` -FilterHashtable @{ LogName = "Security" Id = 4625 StartTime = (get-date).AddMinutes(-5) } ` | where Message -Match "0xC000006D" } catch { $events = @() } "$($events.count)"No warranty for the code, use at your own risk. Please note the use of backtick line continuation for readbility.
