DETERMINING COMPUTER SYSTEM USAGE FROM LOGGED EVENTS

• US 20090254313A1
• Filed: 04/08/2008
• Published: 10/08/2009
• Est. Priority Date: 04/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Armour, David J., Kalki, Jagadeesh
• Granted Patent: US 8,185,353 B2
• Time in Patent Office: Days
• US Class Current: 702/187
• CPC Class Codes: G06F 11/3423 where the assessed time is active or idle time
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Described is a technology by which logged events such as in a security event log (e.g., within a defined timeframe) are processed to determine logon times and logoff times, which are then used to determine system usage. Logoff times may correspond to an actual logoff event, a shutdown event, or another login. In one example, logon and logoff times determine the combined times that each user of the system was logged on, e.g., a total session time for each user. Multiple users'"'"' times may be combined into a total usage time of all users. Each user'"'"'s combined session time may be evaluated against the total usage time to determine whether any user is a primary user, e.g., by being logged on more than a threshold percentage of the total usage time. A primary user may be identified, or the system determined to be a shared system without a primary user.

Claims

1. In a computing environment having a computer-based system, a method comprising, processing logged events to determine logon times and logoff times, and using the logon times and logoff times to determine usage of the system.

2. The method of claim 1 wherein using the logon and logoff times to determine usage of the system comprises determining each user that logged onto the system by differentiating logons each corresponding to singular control of the computer system, and for each user, determining an amount of time that user was logged onto the system.

3. The method of claim 2 wherein determining the amount of time that each user was logged onto the system comprises, for each user, computing a difference value for each logon time and its corresponding logoff time, and summing each difference value for that user.

4. The method of claim 1 wherein processing the logged events to determine logon times and logoff times comprises selecting one logoff time of a plurality of logoff events corresponding to a single logon event.

5. The method of claim 1 wherein processing the logged events to determine logon times and logoff times comprises selecting the logoff time based on a next system shutdown time, a next console logon time, or a last logged time.

6. The method of claim 1 further comprising, determining a total usage time representative of how long a plurality of users were logged onto the system.

7. The method of claim 1 further comprising, providing data that identifies a plurality of users, and for each user, an amount of time that user was determined to have been logged onto the system.

8. The method of claim 1 further comprising, determining a total usage time representative of how long a plurality of users were logged onto the system, computing each user'"'"'s time of being logged onto the system against the total usage time to determine a percentage for that user, and comparing the percentage for each user against a threshold percentage to determine whether any user is a primary user of the system.

9. The method of claim 8 further comprising determining that the system is a shared system when no user is determined to be a primary user.

10. In a computing environment, a system associated with a computing device, comprising:

a log that logs events including logon events; and

a log processing mechanism coupled to the log to scan for a logon event associated with a logon time and determine a corresponding logoff time, and to use the logon time and logoff time to determine usage data corresponding to the computing device.

11. The system of claim 10 wherein the log comprises a security event log of a Windows®

-based operating system.

12. The system of claim 10 further comprising a console usage class and console user class coupled to the log processing mechanism, the console usage class including properties corresponding to a plurality of users of the computing device, and the console usage class including properties corresponding to at least one of the users.

13. The system of claim 12 wherein the console usage class properties include total time data, oldest item data, total number of console logon time data, number of users data, or data identifying a user having a largest console time, or any combination of total time data, oldest item data, total number of console logon time data, number of users data, or data identifying a user having a largest console time.

14. The system of claim 12 wherein the console user class properties include data that identify a user, data representative of a total number of console logon minutes for the user, data representative of a total number of logons for the user, or data representative of a last logoff time for the user, or any combination of data that identify a user, data representative of a total number of console logon minutes for the user, data representative of a total number of logons for the user, or data representative of a last logoff time for the user.

15. The system of claim 10 further comprising a user interface for interacting with the usage data provided by the event log processing mechanism.

16. A computer-readable medium having computer-executable instructions, which when executed perform steps, comprising:

accessing logged event data;

scanning the logged event data to find a logon time associated with a particular user;

determining a logoff time corresponding to the logon time; and

computing a session time for the particular user based upon a difference of the logoff time and the logon time.

17. The computer-readable medium of claim 16 wherein determining the logoff time comprises finding a logoff event, finding a shutdown event, or finding another logon event.

18. The computer-readable medium of claim 16 having further computer-executable instructions comprising, determining a timeframe within the logged data to process, computing other session times within the timeframe for the particular user based upon differences of other logon and logoff times, and determining a summed user time for the particular user based upon a sum of the session time and the other session times.

19. The computer-readable medium of claim 18 having further computer-executable instructions comprising, computing at least one other summed user time corresponding to at least one other user.

20. The computer-readable medium of claim 19 having further computer-executable instructions comprising, determining a primary user based upon the summed user times of the particular user and each other user.