This article applies to:

• WebMarshal
• Marshal Reporting Console  

Question:

• Can I report on browsing activity by user and source workstation?
• How can I find which workstation a user request came from?
• Multiple users abusing a login account

Procedure:

When you are using Windows Authentication with WebMarshal, all browsing reports show the user name. Reports do not show the workstation browsed from. This is true for Marshal Reporting Console and the older reports.

The source machine and IP is logged in the SessionLog table in the SQL database, and also in the Traffic Logging files if Traffic Logging is enabled.

If you need to determine the workstation where a browsing session originated, use one of these two methods:

• Use SQL Server Management Studio to review the SessionLog table.
  • The source IP and machine name for a session are noted in the "Machine" and "IP Address" columns
  • The authenticated user can be determined by looking up the UserGuid in the User table.
• Review the Text Logging files for activity.
  • For each line the source IP  and machine name are noted in the "src" and "srcname" fields, and the authenticated user is noted in the "user" field.

Notes:

When you are using IP Authentication, the "user name" is the workstation name.