Hi, all! Got a quick Fleet question. Is it easy ...
# generalj
Joe B
08/09/2022, 7:11 PMHi, all! Got a quick Fleet question. Is it easy to get stats on user logins and usage times? Thanks!
j
Jason
08/09/2022, 7:13 PMDepends on the platform. Which ones do you want the data for ?
j
Joe B
08/09/2022, 7:14 PMWin / Mac, thanks!
j
Jason
08/09/2022, 7:17 PMFor Mac, I know you can use the
lastappsJason
08/09/2022, 7:18 PMfor Windows you'd probably need to grab just the events you are interested in from the
windows_eventlogJason
08/09/2022, 7:19 PMthere's also the
uptimeJason
08/09/2022, 7:19 PMbut generally just go spelunking through https://osquery.io/schema/5.4.0
j
Joe B
08/09/2022, 7:20 PMCool, thank you for all of that! I’m hoping to get good stats of how much use computers get; can you think of a better way to query that? 🙂
j
Jason
08/09/2022, 7:24 PMHm depends on what you by “use” ? Can you clarify?
j
Joe B
08/09/2022, 7:34 PMWe want to know how much actual use machines get, as opposed to which machines sit idle each day.
Joe B
08/09/2022, 7:35 PMSo, login gets us partway there, but some people leave themselves logged in, so trying to find a better metric
j
Jason
08/09/2022, 7:35 PMAh. You could probably sample cpu usage then every 15 minutes or something like that
Jason
08/09/2022, 7:36 PMOr try and use the ‘processes’ table to determine new processes being spun up
j
Joe B
08/09/2022, 7:36 PMyeah, thanks for the ideas! it seems like Fleet is a very versatile tool
Joe B
08/09/2022, 7:37 PMlooking forward to playing with it
j
Jason
08/09/2022, 7:37 PMYeah it's really up to your imagination
j
Joe B
08/09/2022, 7:37 PMI just hope I can find a good query to base our statistics on 😉
l
Luke Heath
08/09/2022, 8:33 PM@Joe B Just a heads up that there is a dedicated #C01DXJL16D8 channel that you may find helpful.
👍 1
3 Views