How to determine if user logged in with interactive session or not?

[laykun]

Problem Statement

I've been trying to re-write my promQL query to determine at any point if a user is logged into the system or not but I can't seem to make it work with the logon collector. This is for a workroom of computers.

The image shows a couple of days worth of logins by several different users, using the same domain. But I as far as I can tell, there's no information here to determine if that user is still logged into the machine? I presume the timestamps are when they logged in, but that's no especially helpful for me, as I'm essentially trying to create a metric for "bums in seats" in a workroom, so I need to know if a computer is being used or if it's idle without a user logged in.

Thank You!

Environment

• windows_exporter Version: 0.30.2
• Windows Server Version: Windows 10/11 Enterprise Desktop

[laykun]

Before this, I was able to rely on the windows_logon_logon_type gauge, it was super useful!

[jkroepke]

Hi,

first, we should double check if we have the same understanding for the same terms.

From my point of view, if the users starts a remote session, he is logged-in. If he disconnections, without press logout, he is still loggedin, but just disconnected. But technically the sessions is still active and exposed via exporter. If the users click logout, the old sessions should removed from the metrics (if not, there is a bug).

Please explain, why windows_logon_logon_type was super useful? I have to understand the context before I can provide a meaningful solution.

[stijnpieters]

Seems to me old sessions are not removed (at least not anytime soon) after logging out. Not sure if this specific module (logon) and it's single metric right now is intended for this purpose.
What I did notice is that the terminal_services module does keep session states, but in my case (on 0.30.4), sessions only ever report an active or connected state. Never a disconnected state.
I achieve this result through following query windows_terminal_services_session_info{} > 0

Any similar experiences?