Showing posts with label logs. Show all posts
Showing posts with label logs. Show all posts

Monday, March 26, 2012

Finding a user that has multiple log-ins at the same time

I have a table that contains the following

UserName - Which is unique to each user

TimeStart - Which is the time and date that the user logs in

TimeEnd - Which is the time and date that the user logs out

Using SQL, how do you find who has logged in using the same account within the same time period. In other words, Two people are using the same username and are logged in at the same time.

Try this query....


Select
MainQ.*
From
UserLog MainQ
Join
(
Select

Main.UserName,
Main.TimeStart,
Main.TimeEnd
From
UserLog Main
Join UserLog Started On Main.UserName = Started.UserName
And Main.TimeStart <= Started.TimeStart
And Main.TimeEnd >= Started.TimeStart

Group BY
Main.UserName,
Main.TimeStart,
Main.TimeEnd
Having Count(*) <> 1
) as Data
On MainQ.UserName = Data.UserName
And MainQ.TimeStart >= Data.TimeStart
And MainQ.TimeStart <= Data.TimeEnd

Sunday, February 26, 2012

Find database access by tcp connection

Ok, lets see if I can put what I am looking for into words.
I run a MSSQL server, I show in my logs that a connection is being made to my server from a remote ip. I have contact the owner of the ip in question and they state that they have no buisness with us and they should not be connected to us. According to netstat the connection to us is established on 2 different remote ports to 1433. My question, is there any logging on sql that I can turn on, look at to see what database this connection is accessing? ThanksHow about the windows event viewer or sql profiler..

However...how are they connecting id they do not have a login?|||Originally posted by Brett Kaiser
How about the windows event viewer or sql profiler..

However...how are they connecting id they do not have a login?

They must have a userid and password to connect yes, I am trying to find out who it is. None of our clients that I know of are connecting from this location. I'm not familiar with the sql profiler. Where might this be.

Thanks|||It comes with the sql server client tools...

And this guy gave a presentation on it...

http://weblogs.sqlteam.com/billg/archive/2003/11/08/460.aspx|||Hmm. You are really plugging those weblogs these days, Brett ;-). <opening>But I bet I can't find a decent recipe for a margarita there.</opening>

What logs are showing the connections? Do you have success auditing for security turned on on the server?|||Originally posted by MCrowley
Hmm. You are really plugging those weblogs these days, Brett ;-). <opening>But I bet I can't find a decent recipe for a margarita there.</opening>

What logs are showing the connections? Do you have success auditing for security turned on on the server?

Is this a setup?

http://weblogs.sqlteam.com/brettk/archive/2003/10/02/223.aspx