How To Get A List Of Active Users In SharePoint 2010
A few days ago, a question was asked on one of the SharePoint forums. The thread owner wanted to e-mail all active users in the farm to inform them of an upcoming system reboot. In a reply, I thought about using our good old friend – the IIS log. IIS logs per web application and since a farm does not have many, it is possible to track down the relevant places to look into. But how do you define active users? The short answer is you can’t.
However, for practical purposes, you can define a time window or interval and say something like “users who have made a request in the last few minutes are most likely ‘online’ right now”. You define your time interval and zoom in to extract the users (IIS records the logged in user in cs-username column in the logs). But IIS logs, usually stored on daily basis, have so many lines and you need a tool to analyze them.
The Log Parser 2.2 (dates back to 2005) is a great tool and works well with IIS 7.5 and Windows 2008. You will be amazed by what this 1.5 MB installer can achieve. There is a help file and some sample queries in the install folder and you can see online help in this IIS blog and the log parser forums. Log Parser is a command line tool but it uses standard SQL syntax for its queries (there is a beta GUI on codeplex called Visual Log Parser).
So, I downloaded the installer, installed it and picked the current log file for my web application (you can find this from IIS under logging). The query is rather simple:
LogParser “SELECT distinct cs-username INTO test.log FROM C:\inetpub\logs\LogFiles\W3SVC1498786109\u_ex110930.log where time > ’14:30:00′ and time < ’14:40:00′ ” -o:csv
The above line launches Log Parser, provides a select statement and defines the output format (-o:csv or comma separated format) and the file to write to (test.log or better test.csv if you want to open with Excel). My time window is 10 minutes from 2:30 pm (not a busy server, just a test VM). As you can see, the processing is fast and an earlier time window had 3 users active.
Of course, you could count the current users in the query, but to send them e-mail you have to make some further work (map to e-mails and send the message or use some automated process that takes csv log ins as input).
The power of Log Parser should not be underestimated. You can create charts and get other reports and statistics. You can map the logs folder to a local or network drive and run Log Parser from a client machine. I just wanted to illustrate the active users as a proof of concept in the SharePoint context.
