DETERMINING COMPUTER SYSTEM USAGE FROM LOGGED EVENTS
First Claim
1. In a computing environment having a computer-based system, a method comprising, processing logged events to determine logon times and logoff times, and using the logon times and logoff times to determine usage of the system.
2 Assignments
0 Petitions
Accused Products
Abstract
Described is a technology by which logged events such as in a security event log (e.g., within a defined timeframe) are processed to determine logon times and logoff times, which are then used to determine system usage. Logoff times may correspond to an actual logoff event, a shutdown event, or another login. In one example, logon and logoff times determine the combined times that each user of the system was logged on, e.g., a total session time for each user. Multiple users'"'"' times may be combined into a total usage time of all users. Each user'"'"'s combined session time may be evaluated against the total usage time to determine whether any user is a primary user, e.g., by being logged on more than a threshold percentage of the total usage time. A primary user may be identified, or the system determined to be a shared system without a primary user.
-
Citations
20 Claims
- 1. In a computing environment having a computer-based system, a method comprising, processing logged events to determine logon times and logoff times, and using the logon times and logoff times to determine usage of the system.
-
10. In a computing environment, a system associated with a computing device, comprising:
-
a log that logs events including logon events; and a log processing mechanism coupled to the log to scan for a logon event associated with a logon time and determine a corresponding logoff time, and to use the logon time and logoff time to determine usage data corresponding to the computing device. - View Dependent Claims (11, 12, 13, 14, 15)
-
-
16. A computer-readable medium having computer-executable instructions, which when executed perform steps, comprising:
-
accessing logged event data; scanning the logged event data to find a logon time associated with a particular user; determining a logoff time corresponding to the logon time; and computing a session time for the particular user based upon a difference of the logoff time and the logon time. - View Dependent Claims (17, 18, 19, 20)
-
Specification