Track/Audit if User is On- or Offline on Zabbix

[lestho]

Hi,
on my Zabbix installation are many users with difference rights.
Now, in Audit i see when a User is Logged in in the System. BUT, when a user has safed the passwort, in the Audit isnt logd.
I need a LOG/AUDIT what register the Time/Date when a User goes ON- an Offline on the Zabbix Server Web Console.

How can help me?

Thanks!

[cyber]

If someone closes the browser or tab, do you think it will send something towards the page, that was open there?

[lestho]

Good question,
in Zabbix under Administration->Users the “ONLINE?” Status is displayed, and this is exactly the status I would have liked to log.

[cyber]

That comes from "sessions" table. I suspect, that this is updated together with user activity and when last activity is far enough, it is declared as "not online"... But I am truly not sure about how that thing exactly works...

[lestho]

Anyone has a idea?
I need a log so that I can see which user was online with which IP address.
Thanks

[PeterZielony]

Zabbix is monitoring data it has access to but you will need to find that data yourself ( what indicates online/offline).

Then once you have data (log, log file, txt, api or whatever) find which suits you the best. This is good monitoring tool but you need to find best "point of data" that need to be monitored.

[geoffke]

Hi,
on my Zabbix installation are many users with difference rights.
Now, in Audit i see when a User is Logged in in the System. BUT, when a user has safed the passwort, in the Audit isnt logd.
I need a LOG/AUDIT what register the Time/Date when a User goes ON- an Offline on the Zabbix Server Web Console.

How can help me?

Thanks!

You can use the following MySQL query to see which users are online now:

SELECT
t2.userid,
t2.username,
t2.name,
t2.surname,
t2.refresh,
CASE
    WHEN t2.roleid = 1 THEN 'User'
    WHEN t2.roleid = 2 THEN 'Admin'
    WHEN t2.roleid = 3 THEN 'SuperAdmin'
    ELSE t2.roleid
END AS UserType,
t2.theme,
t2.attempt_failed,
t2.attempt_ip,
t2.attempt_clock,
t2.rows_per_page,
FROM_UNIXTIME(t1.lastaccess) as lastaccess,
t1.status
FROM sessions as t1
LEFT JOIN users as t2 ON t1.userid = t2.userid
WHERE
    t1.lastaccess IS NOT NULL
    AND DATE(FROM_UNIXTIME(t1.lastaccess))=CURDATE()
    AND ABS(TIMESTAMPDIFF(MINUTE, FROM_UNIXTIME(t1.lastaccess), NOW())) <= 5
GROUP BY t1.userid, t1.sessionid  
ORDER BY FROM_UNIXTIME(t1.lastaccess) DESC;