I have a lot of users in my PRTG and I'd like to see who's logged in and when we reach peaks. Is that possible?
Created on Sep 16, 2016 10:36:55 AM by
Is there any way to see what users are logged into PRTG?
Votes:
0
66 Replies
Accepted Answer
Votes:
1
This article applies to PRTG Network Monitor 16 or later
Introduction
PRTG can't show the currently logged in users, but it's possible with the script below.
Please save it as PRTG-GetLoggedInUsers.ps1 When you just execute it, it will look like this:
Logged in Users within PRTG
The list will allow you to add filter criteria for each column and show all configured users.
You can also use it as a PRTG sensor, then it will look something like this:
The script configured as a sensor in PRTG
Installation
- Save the script as PRTG-GetLoggedInUsers.ps1 to
%programfiles(x86)%\PRTG Network Monitor\Custom Sensors\EXE - Modify the script's parameters according to the table in the Parameters section of this post
- The script uses Invoke-WebRequest which may lead to PowerShell complaining about the IE not being started yet. The following registry setting will ignore that. Thanks to Daniel Schickmair:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"DisableFirstRunCustomize"=dword:00000001 - Create a new EXE/Script Sensor on the Local Probe device
- Select PRTG-GetLoggedInUsers.ps1 from the EXE/Script dropdown menu
- Hit Continue The sensor should go green with the next scan, given that all parameters are configured correctly. Otherwise, you'll receive an error stating it could not connect to PRTGs webinterface.
Parameters
| Parameter Name | Description | Example |
|---|---|---|
| $prtgProtocol | The protocol used by your PRTG. | Use either http or https. |
| $prtgPort | The port your webinterface uses | 80 |
| $prtgHost | The FQDN of your PRTG webinterface | prtg.acme.com |
| $prtgUser | The user accessing the API | prtgadmin |
| $prtgPasshash | The passhash of the above user | 12345678 |
Notes
- Please don't configure intervals lower than five minutes as it will lead to performance issues otherwise.
Script
#requires -version 4.0
# ___ ___ _____ ___
#| _ \ _ \_ _/ __|
#| _/ / | || (_ |
#|_| |_|_\ |_| \___|
# Active PRTG Users
# ================================
# This script will show you the PRTG users that are currently logged in or have logged in today.
# NOTE: Please don't configure intervals lower than five minutes as it will lead to performance issues otherwise.
#
# Version History
# ----------------------------
# 1.2 Updated to new logging paths of PRTG 18.3.43. Invalid SSL certificates will also work properly now.
# 1.1 Switched to reading users via webinterface.
# 1.05 Changed search method, now takes 0.14s for every user instead of ~3s in large log files
# Better debugging output
# 1.01 Updated comments and documentation
# 1.0 initial release
# # # # # # # # # # # # # # # # # # # # # # # # # #
param(
[string]$prtgProtocol = "http",
[int]$prtgPort = 80,
[string]$prtgHost = "your.prtg.com",
[string]$prtgUser = "prtgadmin",
[string]$prtgPasshash = "12345678"
)
function Console-ShowMessage([string]$type,[string]$message){
Write-Host ("[{0}] " -f (Get-Date)) -NoNewline;
switch ($type){
"success" { Write-Host " success " -BackgroundColor Green -ForegroundColor White -NoNewline; }
"information" { Write-Host " information " -BackgroundColor DarkCyan -ForegroundColor White -NoNewline; }
"warning" { Write-Host " warning " -BackgroundColor DarkYellow -ForegroundColor White -NoNewline; }
"error" { Write-Host " error " -BackgroundColor DarkRed -ForegroundColor White -NoNewline; }
default { Write-Host " notes " -BackgroundColor DarkGray -ForegroundColor White -NoNewline; }
}
Write-Host (" {0}{1}" -f $message,$Global:blank)
}
#region configuration
$progressPreference = 'silentlyContinue'
# ignore invalid ssl certs
add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
# The list of the users
$Users = New-Object System.Collections.ArrayList;
# We'll need the current date to get the correct log file
[string] $currentDate = (date -format "yyyyMMdd");
# Extract the correct data path from the registry
[string] $LogFilePath = ((Get-ItemProperty -Path "hklm:SOFTWARE\Wow6432Node\Paessler\PRTG Network Monitor\Server\Core" -Name "Datapath").DataPath) + "Logs\webserver\WebServer.log"
# Get the content of the log file
[string[]]$LogFileContent = (Get-Content $LogFilePath);
#endregion
function This-GetLogLines([string]$searchstring){
$Lines = ($LogFileContent -match $searchstring)
if($Lines) { return $Lines; }
else { return $false; }
}
# This will retrieve all active users from the configuration file and compare them to the webserver log
function This-GetUsers(){
begin {
Console-ShowMessage -type information -message "Using $($LogFilePath)"
Console-ShowMessage -type information -message "Log is $($LogFileContent.Count) lines long";
Console-ShowMessage -type information -message "Loading Users..."
}
process {
# uncomment the following line if you've forced TLS 1.2 in PRTGs webinterface
# [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
# Receive the current PRTG user list
try {$Object = (Invoke-Webrequest -Uri ([string]::Format("{0}://{1}:{2}/config_report_users.htm?username={3}&passhash={4}", $prtgProtocol,$prtgHost, $prtgPort,$prtgUser, $prtgPasshash)) -SessionVariable PRTG)}
catch {
Console-ShowMessage -type error -message "Could not access PRTG webinterface. Please check URL and credentials!";
Write-Host "0:Could not access PRTG webinterface. Please check URL and credentials!"
#exit 1;
}
Foreach($Link in $Object.Links){
if($Link.OuterHTML -match "edituser.htm" -and [int]$Link.Id)
{ $User = New-Object PSObject –Property @{UserName = $Link.InnerHtml; UserID = $Link.Id}; $Users.Add($User) | Out-Null }
}
# Get a list of all active users in PRTG - others can't login anyway.
Console-ShowMessage -type success -message "Found $($Users.Count) users";
# For every active user in the list ...
$loggedInUsers = Foreach($User in $Users){
Console-ShowMessage information "Checking $($User.UserName)"
#...get the last entry of the user
$Result = (This-GetLogLines -searchstring "user$($User.UserId)");
if($Result)
{ Console-ShowMessage information "$($Result.Length) log entries for this user." -nonewline }
# If the last entry of the user matches logout, he isn't logged in
$LastEntry = $Result[$Result.Length-1]
if($LastEntry -match "logout")
{ $LoggedIn = "No" }
# If any of the above is not the case, he's logged in. Fill the variables accordingly
elseif($LastEntry)
{ $LoggedIn = "Yes" }
if(!($Result))
{ $LoggedIn = "No login today"; $Date = "-"; $Time = "-"; $IP = "-"; }
$LastEntry = $Result[$Result.Length-1] -split " "
if($LastEntry){
# fill the variables with the items from the log line
$Date = $LastEntry[1];
$Time = $LastEntry[2];
$IP = $LastEntry[3];
}
[pscustomobject]@{
"Last Seen" = $Time;
"IP Address" = $IP
"User" = $User.UserName;
"Logged in" = $LoggedIn;
}
}
# We need this for the PRTG output. It will put all logged in users into an array so we can display them in the sensor message
$Userlist = @();
$ActiveUsers = ($loggedInUsers | Where-Object -FilterScript {$_.'Logged in' -match "Yes"});
foreach($ActiveUser in $ActiveUsers){ $Userlist += $ActiveUser.User }
}
End {
# If we have the $prtg parameter set, the script will output data using the EXE/Script format (<value>:<message>);
if($Userlist.Count -eq 0) { $UserString = "" }
else { $UserString = "(" + ($Userlist -join ", ") + ")" }
Write-Host ([string]::Format("{0}:{0} user(s) currently logged in {1}",$Userlist.Count,$UserString));
$loggedInUsers | Out-GridView -Title "[PRTG] Active Users";
}
}
This-GetUsers
Created on Sep 16, 2016 10:54:08 AM by
Last change on Jan 7, 2020 11:09:07 AM by
Votes:
0
Hi Todd,
Did you check if the "Use security context of parent device" option is enabled in the sensor's security settings?
If not, make sure that you've entered administrative credentials in the device settings.
It should work then...let me know if the above did the trick :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 8, 2017 10:14:34 AM by
Votes:
0
Did everything like described above and get
Antwort nicht wohlgeformt: "(Missing or invalid array index expression. At C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXE\PRTG-GetLogg dInUsers.ps1:148 char:46 + $loggedInUsers | Out-GridView -Title "[ <<<< PRTG] Active Users"; + CategoryInfo : ParserError: ([:String) [], ParseException + FullyQualifiedErrorId : MissingArrayIndexExpression )" (Code: PE132)
Version: PRTG Network Monitor 17.3.33.2830 x64
Right now this is just a test on my local client system. Done so before going life on our servers.
Thank you in advance Greets
Last change on Sep 13, 2017 6:24:12 PM by
Votes:
0
Could you post the complete script including credentials? I won't publish it, I just want to make sure everything is configured properly and rule out copy and paste errors.
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 13, 2017 6:27:25 PM by
Votes:
0
The main problem here is that the password was entered instead of the users' passhash. You can find it under <your-prtg>/myaccount.htm?tabid=1 via the button [Passhash anzeigen]. Should work then.
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 14, 2017 8:31:58 AM by
Votes:
0
Hi,
did what you said but ... no success. The Logfile sais
[14.09.2017 14:35:10] information Using C:\ProgramData\Paessler\PRTG Network Monitor\Logs (Web Server)\prtg20170914.log [14.09.2017 14:35:10] information Log is 5970 lines long [14.09.2017 14:35:10] information Loading Users... [14.09.2017 14:35:10] information https://127.0.0.1:443/config_report_users.htm?username=prtgadmin&passhash=******* [14.09.2017 14:35:10] error Could not access PRTG webinterface. Please check URL and credentials! [14.09.2017 14:35:10] success Found 0 users 0:0 user(s) currently logged in
What's my mistake now? Can you please help me out?
Thanks
Greets cyberclaus62
Last change on Sep 14, 2017 12:47:25 PM by
Votes:
0
Just copied it 1:1 into a new ISE window and it works properly:
[14.09.2017 14:45:34] information Using C:\ProgramData\Paessler\PRTG Network Monitor\Logs (Web Server)\prtg20170914.log [14.09.2017 14:45:34] information Log is 6284 lines long [14.09.2017 14:45:34] information Loading Users... [14.09.2017 14:45:35] success Found 5 users [14.09.2017 14:45:35] information Checking Benutzer [14.09.2017 14:45:35] information Checking dashboard [14.09.2017 14:45:35] information Checking PRTG System Administrator [14.09.2017 14:45:35] information 3756 log entries for this user. [14.09.2017 14:45:35] information Checking prtgscheduler [14.09.2017 14:45:35] information Checking Stephan Linke 1:1 user(s) currently logged in (PRTG System Administrator)
Is PRTG actually listening at 127.0.0.1? Like, https://127.0.0.1:443 is showing the PRTG login mask?
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 14, 2017 12:49:18 PM by
Votes:
0
It doesn't run in my ISE neither. I use the connection string
https://127.0.0.1:443/config_report_users.htm?username=prtgadmin&passhash=1234578690
(as you can see in my output above)
But, this string in the address bar of the browser works fine.
The server runs on localhost, 127.0.0.1 and I use https on port 443. There are 3 users defined, 2 admins and one regular user.
I might miss some other thing. Do I need to install some other parts of the PRTG software; I see a scheduler in your output. Or isn't windows 7 new enough for this task? Am I missing some API or a certificate?
Kind regard back to use and many thanks for your work and patience.
Last change on Sep 14, 2017 2:05:00 PM by
Votes:
0
Hi Todd,
Interesting find - I did the same and it actually didn't work. The reason here was the encoding of the file, being set to UTF-8 without BOM. Setting it to UTF-8 made the sensor magically work.
@cyberklaus62 Does this apply to you as well?
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 15, 2017 6:28:08 AM by
Votes:
0
Any HTTPS related errors here?
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 15, 2017 11:23:38 AM by
Votes:
0
Try adding this before the #region configuration:
add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
May or may not work. PowerShell is rather picky when it comes to SSL certificates. Only way around would be to use a signed (valid) SSL certificate instead :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 15, 2017 12:12:32 PM by
Votes:
0
Frank,
Could you post the exact error?
Kind regards,
Stephan Linke, Tech Support Team
Created on Sep 26, 2017 10:04:11 AM by
Votes:
0
(Sorry for the delay; I was ill.) Hi Stephan,
it's the same error as has been posted by cyberclaus62 previously:
[10.10.2017 14:00:26] information Using D:\Paessler\PRTG Network Monitor\Logs (Web Server)\prtg20171010.log [10.10.2017 14:00:26] information Log is 11715 lines long [10.10.2017 14:00:26] information Loading Users... [10.10.2017 14:00:26] error Could not access PRTG webinterface. Please check URL and credentials! 0:Could not access PRTG webinterface. Please check URL and credentials! [10.10.2017 14:00:26] success Found 0 users 0:0 user(s) currently logged in
Although the message seems clear, when I access the url with correct credentials from my computer or from the core server itself (just after this error occurred), then the page is shown without error in the browser...
Any thoughts? Thanks and regards, Frank
Last change on Oct 10, 2017 12:28:13 PM by
Votes:
0
Hi Frank,
Please modify the script and add the following beneath the Console-ShowMessage:
Console-ShowMessage -type error -message "Could not access PRTG webinterface. Please check URL and credentials!"; Write-Host $_.Exception.Message
What's the Exception message?
Kind regards,
Stephan Linke, Tech Support Team
Created on Oct 10, 2017 12:30:06 PM by
Votes:
0
Hi Frank,
While this would be the common workaround, I'm unsure if it will work. I'll do some testing tomorrow.
Kind regards,
Stephan Linke, Tech Support Team
Created on Oct 12, 2017 1:45:51 PM by
Votes:
0
Hi Frank,
-UseBasicParsing will work, but you'll not see any usernames in the list, so it's of little use. Is the sensor configured to actually use the account of the parent device in the security context setting? When launching IE with this very user, you should see the following:
Did you click OK in this dialogue? If so, the script should work when executed while being logged in as this user. Let me know if it did the trick :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Oct 13, 2017 12:49:13 PM by
Votes:
0
API users count as "logged in", too. It's very strange and I haven't observed this behavior :( I'm out of ideas to be honest...maybe something like this will be implemented natively one day :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Nov 1, 2017 9:39:04 AM by
Votes:
0
Hi Frank,
Nice! :) The -1 would be possible by replacing the following line at the end:
Write-Host ([string]::Format("{0}:{0} user(s) currently logged in {1}",$Userlist.Count,$UserString));
with the following:
Write-Host ([string]::Format("{0}:{0} user(s) currently logged in {1}",($Userlist.Count - 1),$UserString));
Created on Nov 8, 2017 1:51:05 PM by
Last change on Nov 8, 2017 1:55:39 PM by
Votes:
0
Hi Frank,
That's one way to do it :) Thanks for your perseverance as well!
Glad it works now, it took quite long, but as they say:
The journey is the reward.
Have a great weekend!
Kind regards,
Stephan Linke, Tech Support Team
Created on Nov 10, 2017 9:47:06 AM by
Votes:
0
Did you set the security context of the sensor in its settings to be an administrative user? It needs to access the registry and log files that may not be available to the currently configured user account.
Kind regards,
Stephan Linke, Tech Support Team
Created on Nov 15, 2017 8:21:43 AM by
Last change on Nov 15, 2017 2:38:55 PM by
Votes:
0
You're most welcome :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Nov 15, 2017 2:39:17 PM by
Votes:
0
Hi Stephan,
We still cannot get the script to output a value to our Sensor. I see in the script itself:
End {
# If we have the $prtg parameter set, the script will output data using the EXE/Script format (<value>:<message>}}}
Do we need to enable this $prtg parameter somewhere in the script in order to get the result into a sensor? If so, how do we do that? (It isn't immediately obvious from the script itself.)
Thanks
Todd
Last change on Dec 20, 2017 7:51:19 AM by
Votes:
0
Hi Todd,
The -prtg switch is no longer necessary, as the output is always posted in PRTG format. I understand that you do get results when the script is run manually, right? It should also output an actual message stating the amount of users and a list of them. Is that the case? To recap:
- Make sure that the user used for PRTG access is administrative
- Check if it works with using the credentials of the parent device (in the sensor settings).
- Make sure that you're indeed using the passhash, and not the password of the account
- The account used for the PRTG Probe Service needs access to
%programdata%\Paessler\Logs (Web Server) - Check if the script is saved without BOM via Notepad++
- PRTG is able to execute PowerShell scripts properly
Can't think of any others right now... let me know if either step worked :)
Kind regards,
Stephan Linke, Tech Support Team
Created on Dec 20, 2017 8:00:01 AM by
Last change on Dec 20, 2017 8:00:17 AM by
Votes:
0
Hey Frank,
The script should actually only show the logged in users...when you execute the script manually, you'll see a list of users with the LoggedIn flag set accordingly - does that match the current user count?
Kind regards,
Stephan Linke, Tech Support Team
Created on Feb 6, 2018 4:22:22 PM by
Votes:
0
Nope, it shouldn't count inactive sessions:
$ActiveUsers = ($loggedInUsers | Where-Object -FilterScript {$_.'Logged in' -match "Yes"});
See, it filters the active users, only users that have "Logged In" set to yes are counted. Furthermore, only logs from the current day are checked. Really not sure what's causing this ... :(
Created on Feb 12, 2018 7:12:02 AM by
Votes:
0
Starting with PRTG Release 18.4.46.1706 this feature is now built-in.
You can now see the names of all PRTG user accounts that are currently logged in to your PRTG instance! Open the PRTG System Status page in the web interface via the main menu (Setup | PRTG Status) and look at section Software Version and Server Information. There is the new entry Active User Sessions that shows all currently logged in PRTG users.
Votes:
0
Yeah, the script is basically to correlate the amount of users logged in to performance issues that may occur within PRTG, due to many search queries or something like that :)
PRTG Scheduler |
PRTGapi |
Feature Requests |
WMI Issues |
SNMP Issues
Kind regards,
Stephan Linke, Tech Support Team
Created on Nov 28, 2018 9:12:39 AM by
Votes:
0
since a couple of weeks, this doesn't work anymore. we get the following error
[18.02.2021 13:44:42] information Using D:\Data\PRTG Network Monitor\Logs\webserver\WebServer.log [18.02.2021 13:44:42] information Log is 55626 lines long [18.02.2021 13:44:42] information Loading Users... [18.02.2021 13:44:42] error Could not access PRTG webinterface. Please check URL and credentials! 0:Could not access PRTG webinterface. Please check URL and credentials! The URI prefix is not recognized. [18.02.2021 13:44:42] success Found 0 users 0:0 user(s) currently logged in
the credentials are correct and also the url. is there anything I could check?
Last change on Feb 18, 2021 3:26:59 PM by
Votes:
0
Hi Jörg
I would recommend to take a look here. It seems like the issue already occurred.
Kind regards
Felix Wiesneth - Team Tech Support
Created on Feb 19, 2021 2:38:01 PM by
Votes:
0
The configured passhash is not to be preceeded by h:, only the numerical number is required. Additionally, ensure that the First Run Wizard in IE is also disabled. The error indicates that this is likely the issue with your instance :)
Created on Jun 14, 2021 11:24:54 AM by
Votes:
0
Hello juanrodrigues2022,
Did you set the "Security Context" in the sensor settings to "Use Windows credentials of parent device"?
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Mar 23, 2022 7:57:52 AM by
Votes:
0
Hello juanrodrigues2022,
Did you enter user credentials in the "Settings" tab of the device (on which you added the sensor) in the section "Credentials for Windows"?
I would suggest that you enter the user that you used to run the script manually.
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Mar 23, 2022 12:29:50 PM by
Votes:
0
Hello juanrodrigues2022,
I think we need to take a closer look at this sensor. Please open a support ticket, and provide us with some screenshots of the sensor (Overview, Log, Settings tab).
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Mar 25, 2022 7:04:57 AM by
Votes:
0
There were indeed some changes to the WebServer.log in the latest version (22.2.77), which causes that the script no longer works. We would need to check if we can make some additional changes to the WebServer.log file in order to get the script working again.
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Jul 14, 2022 5:14:48 AM by
Votes:
0
I have just tested the script in the latest version (22.4.81) and it seems to be working again.
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Jan 20, 2023 9:21:32 AM by
Votes:
0
@Dorian_PARIS,
I would suggest that you open a support ticket so that we can have a closer look at the sensor.
Kind regards,
Sasa Ignjatovic, Tech Support Team
Created on Jan 23, 2023 8:25:33 AM by
Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
Add comment