Good afternoon all, I'd like to use auditlog to give me the amount of time people are spending logged on but I can't seem to get the information I want. When a user disconnects and doesn't reconnect within 3 hours, his/her session is ended. But it looks like that a log off event is not written to the event log. Therefore, when I run auditlog /time, the output gives me something like: * Logon: 06/11/2002 16:04 CurTm: 14/11/2002 11:51 Total: 187:47:00 Logon: 08/11/2002 12:44 Logoff: 08/11/2002 12:54 Total: 00:09:18 * Logon: 12/11/2002 10:09 CurTm: 14/11/2002 11:51 Total: 49:41:47 * Logon: 12/11/2002 10:30 CurTm: 14/11/2002 11:51 Total: 49:21:09 Logon: 12/11/2002 11:21 Logoff: 12/11/2002 11:22 Total: 00:00:57 Logon: 12/11/2002 15:51 Logoff: 12/11/2002 15:53 Total: 00:01:08 * Logon: 14/11/2002 10:25 CurTm: 14/11/2002 11:51 Total: 01:25:37 Total logon time: 288:26:56 where all the records marked * are sessions which have been automatically disconnected after 3 hours. The server is auditing success and failure for "account logon events" and "logon events" so I don't really know what I'm missing. I also set the auditing at the citrix ica session level. Is auditlog behaving the way it should? Is my auditing properly configured? Does anyone know how to have an event written to the event log whenever a disconnected session is ended or know a workaround to get what I want (the real amount of time a user is logged on (being connected or not))? Thanks for any help Cheers Francois __________________________________________________ Virus checked by MessageLabs Virus Control Centre. *********************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link. http://thethin.net/citrixlist.cfm