Understanding "Primary User" Calculation Methods in 8.x

Products

• IT Management Suite

Issue/Introduction

The following information is provided as a reference in how Primary User calculation works based on recent 8.x versions.

Environment

ITMS 8.1 and later

Cause

Customer Education

Resolution

QUESTION
How is the Primary User information captured?

ANSWER
The process for determining the Primary User is multi- tiered. The Symantec Management Agent (SMA) monitors user logins and logoffs and stores information about every user session in the AeXUserMonitorLog.xml once the session is logged off. The AeXUserMonitorLog.xml file is stored in the install directory of the SMA. This log contains a list of all user logon durations within the last 28 days. When user logs in or logs off the SMA sends Evt_AeX_Client_LogOn NSE to the server.  An example of this file is:

<UserLog>
     <Log userID="[Domain]\[Username]" duration="756606" utc_day="7" utc_month="2" utc_year="2023" utc_lastloggedon="2023-01-28 21:03:14 -7:00"/>
     <Log userID="[Domain]\[Username]" duration="756606" utc_day="7" utc_month="2" utc_year="2023" utc_lastloggedon="2023-01-28 21:03:14 -7:00"/>
     <Log userID="[Domain]\[Username]" duration="820921" utc_day="17 "utc_month="2" utc_year="2023" utc_lastloggedon="2023-02-07 07:20:53 -7:00"/>
</UserLog>

The Symantec Management Agent uses this file to calculate who the Primary User is for the client computer.

The following registry key controls the days that primary user is calculated on, this key is set to 28 by default:

HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Inventory\PrimaryUserRecordDays

For each <log> entry inside the AeXUserMonitorLog.xml file, if the date and time for the utc_lastloggedon are older than 28 days then the SMA will remove these entries from the log file so that the Primary User will not be calculated based on the older records.  The durations recorded inside the AeXUserMonitorLog.xml are in seconds, and the time is calculated in UTC.

 

QUESTION
How is the primary user calculated?

ANSWER
The algorithm is quite simple:

• The Primary User information is initially collected by Basic Inventory
• The AeXUserMonitorLog.xml stores the history of user sessions
• The SMA calculates Primary User information prior to the Basic Inventory update
• -- takes all the old sessions from XML, adjusts them to 28 day limit
• -- takes all the current sessions from Windows, adjusts them to 28 day limit
• -- sums up durations of all the sessions for each user and selects the user with the longest duration as the primary user

 

QUESTION
Which registry location and values are used for calculating primary user?

ANSWER
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Inventory

Key	Type	Value (some as example)	Description
PrimaryUserRecordDays	REG_DWORD	0x1c	Sets 28 day limit, can be changed at any time. No SMA restart is needed
PrimaryUser	REG_SZ	altiris\jdoe48	Holds the currently selected primary user

 

QUESTION
Can the "PrimaryUserRecordDays" value be edited to 14 days globally?

ANSWER
The user can change it via the registry and this would need to be done on each machine. The user could run a task on all the agents that changes this registry location to the desired value.

 

QUESTION
How are these tables used?

ANSWER

dbo.Inv_AeX_AC_Primary_User	filled by basic inventory info
dbo.Evt_AeX_Client_LogOn	filled by logon/logoff NSE sent by agents

The Symantec Management Platfrom Server (SMP or Notification Server) provides an inventory dataclass that records who the Primary User is on each SMA-enabled computer.   This dataclass is called “AeX AC Primary User” and is found in the Resource Manager by clicking on the Inventory tab. The "Inv_AeX_AC_Primary_User" table is the storage location for the "AeX AC Primary User" dataclass.

Additional Information

179972 What inventory is recorded with a Basic Inventory?