Computer Usage Monitoring, Tracking, and Reporting Systems – Using System Log Files or Commercial Software

Technology

UPDATE: 23 Dec 2022

The original document below was posted on 18 June 2011. Given changes in technology and remote management, it is mostly outdated with regard to the specific recommendations. It may be of value to anyone researching the state of the industry in 2011.

For those seeking present-day solutions, a common choice would be endpoint services and software from Microsoft to handle deployment, management, authentication, and security. [Learn More]

Multi-platform systems like Watchman Monitoring are help for support, maintenance, updates, and asset inventory management. [Learn More]

Original Article

Summary. This document provides some retail solutions as well as do-it-yourself solutions for computer usage reporting.

Monitor. It’s sometimes helpful to know computer usage over a given period of time.

For example, when evaluating the use of shared or public computers, one wants to know the utilized value of those computers compared to the cost of maintaining them.

Perhaps ten computers are maintained, but only five are regularly used. Or, perhaps ten computers are maintained, and they are so heavily used that purchasing more would be justified.

System Log Files. Using system log files is perhaps the cleanest and most secure method of tracking the basic usage of computers. To do so, follow these instructions.

1. Apple users, skip to step #2. For Windows computers, click the Start Menu, right click on Computer, select Manage. Navigate the structure from Computer Management (Local) > System Tools > Even Viewer > Applications and Services Logs > Microsoft > Windows > User Profile Services > right click on Operational and then choose Save All Events As. This will allow you to save the event log to a file. For Save as Type choose CSV (Comma Separated Values) and provide a file name, saving in a location where you’ll find it easily.
2. For Apple computers, follow the instruction guide to Creating Apple Login and Logout Scripts to Track Computer Usage in Console System Log Files. Then continue to step #3. Or, alternatively, refer to the document Using Apple Mac Console Event Log Files to Report Login and Logout Times for Calculating Computer Usage. Then skip the remaining steps.
3. Use Microsoft Excel to open and sort log entries. From the File menu, choose New Workbook. Then, from the File menu, choose Import, select CSV file, then click the Import button. You will then be at the Choose a File dialog box.
4. Remember that you’d previously exported the user-profile-service log file as a CSV formatted file, so it will be visible and can be opened. However, you will need to select the All Files option from the drop down selection to the right of Enable, in order to open the usertracking.log file. The All Files option allows you to see all files, including those not normally recognizable by Excel. Click on the log file you want to import, and press the Get Data button.
   1. Apple users can use the usertracking.log file crated in step #2 to calculate the time differential from the login and logout times.
   2. Windows users should look in the user-profile-service log file for Finished processing user logon notification and Finished processing user logoff notification as the login and logout markers.
5. In the Text Import Wizard – Step 1 of 3 choose Delimited as the original data type, and then click Next.
6. In the Text Import Wizard – Step 2 of 3, under the Delimiters heading, Comma should be the only item checked, then click Next.
7. In the Text Import Wizard – Step 3 of 3, it’s necessary to indicate the data format for each column. The date and time column should be set as Date DMY. To do this, click on the column with the date, and then choose the Date format above, then click the Finish button.
8. In the Import Data dialog box, select New Sheet and then press the OK button.
9. Apple users, skip to step #10. Windows users can now cleanup and organize the user-profile-service log data by following these steps
   1. Use Column A as the column to put your computer name, in case you have more log files you plan to merge, then each computer’s data can be distinguishable. The column heading name might be something like “Level” — replace it with the word Computer. Replace the word Information in Column A with the name of the computer. Do this by typing the computer name in cell A2, then press Enter. Then, click on the name you just entered. Then press Shift + Control + Down Arrow. This will select all data in column A. Then press Control + D to fill down the name you entered in Cell A2. Now all records in this sheet are labeled as coming from that computer.
   2. Column B should be the Date and Time. Columns C (Source), D (Event ID), and E (Task Category) can be deleted. Highlight them by clicking the mouse on the Column Heading C and dragging it to the Column Heading E. Then, from the Edit menu, choose delete.
   3. Select Column B and C, then from the Insert menu choose Columns. This will insert two blank columns B and C, with the date now as Column D and column E being the event log details. Type Details as the column heading under E. Beneath column B type Minutes and beneath column C type Hours. This is where you can display the time used in total minutes or total hours for each session.
   4. Select Row 2 by clicking the “2” with your mouse. Press Shift + Control + Down Arrow to select all rows of data. From the Data menu, choose Sort, and choose to sort on column E by selecting Column E under the Column Selection heading, then click OK. All the data will now be sorted alphabetically by details.
   5. Delete all data that isn’t described as “Finished processing user logoff” or “Finished processing user logon.” Select rows sequentially above and below using the Shift + Control + Up Arrow or Down Arrow as previously described, and delete them as needed. Now you’ll be left with a spreadsheet showing login and logout times.
   6. Sort all the data again, this time by the date/time column. This will place all records in chronological order from the oldest record of a logon and logoff.
   7. In Cell B3 place the following formula to calculate the number of minutes the computer was used during a session =IF(DAY(D3)-DAY(D2)<1,((HOUR(D3)-HOUR(D2))*60)+(MINUTE(D3)-MINUTE(D2)),(((DAY(D3)-DAY(D2))*1440)+(HOUR(D3)*60)+(MINUTE(D3))))
   8. In Cell C3 place the following formula in the hours cell =B3/60
   9. You can format Column 3 to not have so many numbers after the decimal. Select the column, then right click on it, choose Format Cells, select Category > Number then 2 decimal places and click OK.
   10. At this point, you have the basic formula to be used for all logout calculations. To copy this to the other logout records, sort all data by Details. The formula results will now say #VALUE! because the source data has moved. However, the formula is still valid. Copy the formula down for all logoff records, by selecting the formula and all cells below it down to include all logout records, then choose Control + D to fill down. Then sort the data again by date. Now, you can use the SUM, AVERAGE, COUNT, and COUNTBLANK functions to calculate the total hours, average hours, and number of logins and logouts.
10. Apple users can follow the general principles outlined above under step #9 to create formulas that will calculate total time used. Or, refer to the document Using Apple Mac Console Event Log Files to Report Login and Logout Times for Calculating Computer Usage. Then skip the remaining steps.
11. If you have more than one log file, you can combine them, but be sure the columns are the same and for each data set add a column with the computer name and fill down the name.

Software for Computer Monitoring. Software programs are available to track computer usage. For example, PC On/Off Time by Neuber is a program that calculates computer usage based on system log files, and then displays that information in a three-week 24-hour graph. More detailed analysis, including individual program usage, can be tracked and reported using programs like Visual Time Analyzer by Neuber.

Internet usage monitoring programs are used by parents to watch over their children’s online activities and employers to track the productivity of all Internet activity. However, these programs don’t typically track computer usage.

Some computer monitoring software pushes the limits of computer usage tracking and surveillance by recording every screen viewed, every keystroke, and even passwords typed. In addition to the privacy and intrusion concerns, these are potentially dangerous because some include remote viewing and management capabilities that could be exploited. Having a detailed history of all confidential data on a computer, including passwords typed, leaves the computer vulnerable to hackers who would only need to download the keystroke recordings to gain access to everything. It’s not advisable to use any such software unless you are fully confident in the trustworthiness of the developer and vendor.

SpectorSoft.com is a developer and provider of computer and Internet monitoring software. Some of their products work on Apple as well as Windows computers. Their products have received positive mention in the press and professional awards. Their products Spector Pro for Mac 2011 and Spector Pro for Windows 2011 make it possible to use the same program for multiple platforms.