Collector scripting for access error detection

Yeah, scripting it will be best (unless you can create your access log in json format with the data already calculated and host that on an http microservice). If you go the scripting route, however you want to script grabbing the contents of that file should be fine: ssh, remote-powershell, SMB, http microservice, etc.

Once you have the log file contents pulled into your script, you'll want to parse through it twice: once to grab the list of users for discovery and once to grab the number of logons per user. I would suggest making a derive datapoint as that will treat the number of logons as a counter. This means that it will take the current count minus the last count and divide by the time between them. You can multiply by ##POLLINTERVAL## to get back to the raw delta.