Azure Vm hour check

Hi @Anirban Sarkar ,

if this is your requirement:

Like if a user is using a vm using rdp, how long is he/she using it until he shuts down the vm.

Neither monitoring the network traffic nor monitoring the CPU workload helps to get the required details "which user is using the VM and how long".

• The CPU workload doesn't provide any detail of the user or user's computer. If the user is just idling in the RDP session it's hard to detect by monitoring the CPU.
• Monitoring the network traffic might give details about the IP of the user's computer. But even than it's not a reliable method to get the user details (start/end RDP session).

I would suggest to get the login/logoff information from the Security Event Log of the VM.
The EventID 4624 shows the successful logged on of a user, including the user name and the date/time details.
EventID 4647 shows the user initiated the logoff, including the user name and the date/time details

If you get both events it's possible to do the math how long a user was connected to the VM.

With Azure Log Analytics it's possible to collect the Event Log information: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events
The data can be queried in the Azure Log Analytics Workspace using Kusto:
https://techcommunity.microsoft.com/t5/azure-observability/oms-query-for-ad-login-and-log-offs/m-p/162689

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Hi @Anirban Sarkar

I have already answered this question in your last question . Kindly refer https://learn.microsoft.com/en-us/answers/questions/966324/azure-vm-rdp-issues.html

You can use Azure VM Insights . Pretty sure when a user is using the Machine , it will have some CPU usage.

-----------------If you find this answer helpful , Kindly accept the answer ------------

Hello @Anirban Sarkar

Thank you for your post.

Also, I really appreciate the great info gather from @Mohammed Altamash Mohammed Suleman Khan and @Andreas Baumgarten : )

Now let me paste back part of the article that I was given previously so check this out below:

It's vital to monitor, manage, and know your own network for uncompromised security, compliance, and performance. Knowing your own environment is of paramount importance to protect and optimize it. You often need to know the current state of the network, including the following information:
Who is connecting to the network?
Where are they connecting from?
Which ports are open to the internet?
What's the expected network behavior?
Is there any irregular network behavior?
Are there any sudden rises in traffic?

URL is this one >>> https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

Now on this case scenario, you might need some technology similar from what on-premises has been using which is:

-IPFIX

-Sampling

-IPFLOW

-Traffic collector

-If you have any NVA(Network Virtual Appliance or Stateful firewall, you can use session-INIT and session-END at the end of each security rule which will be logging every time a session is started and ended up.

-NSG using logging feature as well.

-The last post made can be used as well as for complementing what you see on your traffic analysis.

I hope this was useful to have a better understand of this.

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Hi @Anirban Sarkar ,

your requirement Like if a user is using a vm using rdp, how long is he/she using it until he shuts down the vm. -> Sounds for me you require the user information as well.

If it's just "how many hours the VM was running per month", without user details it's easier. Please take a look here: https://techcommunity.microsoft.com/t5/azure-observability/azure-virtual-machine-runtime-calculation/m-p/191753

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten