Determining computer system usage from logged events

• US 8,185,353 B2
• Filed: 04/08/2008
• Issued: 05/22/2012
• Est. Priority Date: 04/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Armour, David J., Kalki, Jagadeesh
• Primary Examiner(s): Khuu, Cindy H
• Application Number:
  US12/099,155
• Publication Number:
  US 20090254313A1
• Time in Patent Office: 1,505 Days
• Field of Search: 702/187
• US Class Current: 702/187
• CPC Class Codes: G06F 11/3423 where the assessed time is active or idle time
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Described is a technology by which logged events such as in a security event log (e.g., within a defined timeframe) are processed to determine logon times and logoff times, which are then used to determine system usage. Logoff times may correspond to an actual logoff event, a shutdown event, or another login. In one example, logon and logoff times determine the combined times that each user of the system was logged on, e.g., a total session time for each user. Multiple users'"'"' times may be combined into a total usage time of all users. Each user'"'"'s combined session time may be evaluated against the total usage time to determine whether any user is a primary user, e.g., by being logged on more than a threshold percentage of the total usage time. A primary user may be identified, or the system determined to be a shared system without a primary user.

Claims

1. A method comprising, employing at least one processor to perform steps including, processing logged events to determine logon times and logoff times, using the logon times and logoff times to determine usage of the system, determining a total usage time representative of how long a plurality of users were logged onto the system, computing each user'"'"'s time of being logged onto the system against the total usage time to determine a percentage for that user, and comparing the percentage for each user against a threshold percentage to determine whether any user is a primary user of the system.

2. The method of claim 1 wherein using the logon and logoff times to determine usage of the system comprises determining each user that logged onto the system by differentiating logons each corresponding to singular control of the computer system, and for each user, determining an amount of time that user was logged onto the system.

3. The method of claim 2 wherein determining the amount of time that each user was logged onto the system comprises, for each user, computing a difference value for each logon time and its corresponding logoff time, and summing each difference value for that user.

4. The method of claim 1 wherein processing the logged events to determine logon times and logoff times comprises selecting one logoff time of a plurality of logoff events corresponding to a single logon event.

5. The method of claim 1 wherein processing the logged events to determine logon times and logoff times comprises selecting the logoff time based on a next system shutdown time, a next console logon time, or a last logged time.

6. The method of claim 1 further comprising, determining a total usage time representative of how long a plurality of users were logged onto the system.

7. The method of claim 1 further comprising, providing data that identifies a plurality of users, and for each user, an amount of time that user was determined to have been logged onto the system.

8. The method of claim 1 further comprising determining that the system is a shared system when no user is determined to be a primary user.

9. In a computing environment, a system associated with a computing device, comprising:

a log configured to log events including logon events;

a log processing mechanism coupled to the log and configured to scan for a logon event associated with a logon time, to determine a corresponding logoff time, and to use the logon time and logoff time to determine usage data corresponding to the computing device for each user of the computing device and a total usage time for all users; and

a usage analysis component configured to determine, from the usage data, a primary user of the computing device, including by comparing the usage data for each respective user against the total usage time to determine a relative usage for the respective user, and comparing the relative usage for each user against a threshold usage to determine whether any user is a primary user of the system.

10. The system of claim 9 wherein the log comprises a security event log of a Windows®

-based operating system.

11. The system of claim 9 further comprising a console usage class and console user class coupled to the log processing mechanism, the console usage class including properties corresponding to a plurality of users of the computing device, and the console usage class including properties corresponding to at least one of the users.

12. The system of claim 11 wherein the console usage class properties include total time data, oldest item data, total number of console logon time data, number of users data, or data identifying a user having a largest console time, or any combination of total time data, oldest item data, total number of console logon time data, number of users data, or data identifying a user having a largest console time.

13. The system of claim 11 wherein the console user class properties include data that identify a user, data representative of a total number of console logon minutes for the user, data representative of a total number of logons for the user, or data representative of a last logoff time for the user, or any combination of data that identify a user, data representative of a total number of console logon minutes for the user, data representative of a total number of logons for the user, or data representative of a last logoff time for the user.

14. The system of claim 9 further comprising a user interface for interacting with the usage data provided by the event log processing mechanism.

15. A hardware computer storage medium having computer-executable instructions stored thereon, which in response to execution by a computer, cause the computer to perform steps, comprising:

accessing logged event data;

scanning the logged event data to find a plurality of logon times, each logon time associated with a user of a plurality of users of a computing device;

determining logoff times corresponding to the logon times;

computing session times for each of the plurality of users based upon a difference of the logoff times and the logon times;

comparing the session times of each of the plurality of users to the total session times of all of the plurality of users, and

identifying a primary user of the computing device based, at least in part, on the comparing.

16. The hardware computer storage medium of claim 15 wherein determining the logoff times comprises finding at least one of a logoff event, a shutdown event, or another logon event.

17. The hardware computer storage medium of claim 15 having further computer-executable instructions stored thereon, which in response to execution by the computer, cause the computer to perform further steps comprising, determining a timeframe within the logged data to process, computing other session times within the timeframe for a particular user based upon differences of other logon and logoff times, and determining a summed user time for the particular user based upon a sum of the session time and the other session times.

18. The hardware computer storage medium of claim 17 having further computer-executable instructions stored thereon, which in response to execution by the computer, cause the computer to perform further steps comprising, computing at least one other summed user time corresponding to at least one other user.

19. The hardware computer storage medium of claim 18 having further computer-executable instructions stored thereon, which in response to execution by the computer, cause the computer to perform further steps comprising, determining the primary user based upon the summed user times of the particular user and each other user.