ASP.NET - 记录用户会话开始/结束时间为审计跟踪 - 的Global.asax？ [英] ASP.NET - Log User Session Start/End Times for Audit Trail - Global.ASAX?

问题描述

我的ASP.NET的Intranet Web应用程序使用Windows身份验证，我想记录以下细节：

1）的Windows ID结果
2）会话开始时间结果
3）会议结束时间结果
4）网址被浏览到（可选）结果

我有在Global.asax的在session_start的方法来记录会话的开始时间（如下图所示），一些基本的code设置，但仅此而已至今。我有一种感觉，这是一种原始的方法，有这样做的更好的方式。所以，我真的有两个问题：

1），这是去这样做的正确方法？如果不是有一些其他的选择吗？搜索结果
2）如果这是正确的方式，我只需要下降一些code。在Session_End中的方法来记录时间，他们退出，那是一个完整的解决方案？请问这种方法时，他们关闭浏览器选项卡总是被调用他们的网站打开，或者他们不得不关闭整个浏览器（我没有注销功能）？用户可以通过其他方式跳过此会话结束方法（或启动该情况）？

 昏暗connsql作为新System.Data.SqlClient.SqlConnection(ConfigurationManager.ConnectionStrings(\"MyConnectionstring\").ConnectionString)
    昏暗cmdsql作为System.Data.SqlClient.SqlCommand = connsql.CreateCommand
    cmdsql.CommandText =BeginUserSession
    cmdsql.CommandType = Data.CommandType.StoredProcedure
    尝试
        cmdsql.Parameters.Add（@ windowsid，System.Data.SqlDbType.VarChar，30日，windowsid）
        cmdsql.Parameters（@ windowsid）。值=会议（的UserInfo）。identity.name
        如果connsql.State＆LT;＆GT; System.Data.ConnectionState.Open然后connsql.Open（）
        cmdsql.ExecuteNonQuery（）
        connsql.Close（）    抓住EX为例外    最后
        如果connsql.State＆LT;＆GT; Data.ConnectionState.Closed然后connsql.Close（）
    结束Try
    存储过程的记录启动时间
 

解决方案

Session_End中是不可靠的。

我的建议是在session_start您创建的笔记会话创建时间的记录，并在Session_End中你更新它结束的时间记录。

要处理其中大部分是被动地放弃了会话，使用的Application_BeginRequest更新的记录要注意，当用户在最后一次见到。

您接着需要确定标志已经被动放弃的会话的方式。这将是网站/应用特定的。这可能是因为捡若干分钟前会话被视为放弃必须经过简单 - 像10分钟

这样，那么你有一个查询：

  SELECT用户名，
       SessionStart，
       SESSIONEND，
       LastSeenOn，
       DATEDIFF（MI，SessionStart，ISNULL（SESSIONEND，LastSeenOn））DurationMinutes
从SessionAudit
WHERE SESSIONEND IS NOT NULL
OR DATEDIFF（MI，LastSeenOn，GETDATE（））＆GT; 10
 

这将带回您的会话审计日志。

My ASP.NET intranet web application uses Windows Authentication, and I would like to record the following details:

1) Windows ID
2) Session Start Time
3) Session Stop Time
4) URL being browsed to (optional)

I've got some basic code setup in "Session_Start" method of the Global.ASAX to log session start times (seen below), but that's it so far. I have the feeling this is a primitive approach and there are "better" ways of doing this. So I really have two questions:

1) Is this the right way to go about doing this? If not what are some other options?

2) If this is the right way, do I just need to drop some code in the "Session_End" method to record the time they exit, and thats a complete solution? Does this method always get called when they close the browser tab they have the site open in, or do they have to close the entire browser (I don't have logout functionality)? Any way users can skip over this session end method (or start for that case)?

    Dim connsql As New System.Data.SqlClient.SqlConnection(ConfigurationManager.ConnectionStrings("MyConnectionstring").ConnectionString)
    Dim cmdsql As System.Data.SqlClient.SqlCommand = connsql.CreateCommand
    cmdsql.CommandText = "BeginUserSession"
    cmdsql.CommandType = Data.CommandType.StoredProcedure
    Try
        cmdsql.Parameters.Add("@windowsid", System.Data.SqlDbType.VarChar, 30, "windowsid")
        cmdsql.Parameters("@windowsid").Value = Session("UserInfo").identity.name
        If connsql.State <> System.Data.ConnectionState.Open Then connsql.Open()
        cmdsql.ExecuteNonQuery()
        connsql.Close()

    Catch ex As Exception

    Finally
        If connsql.State <> Data.ConnectionState.Closed Then connsql.Close()
    End Try
    'Stored Proc records start time

解决方案

Session_End is not reliable.

What I would suggest is on Session_Start you create a record that notes the time the Session was created, and in Session_End you update the record with the time it was ended.

To handle the majority of sessions which are passively abandoned, use Application_BeginRequest to update the record to note when the user was "last seen".

You will then need to determine a way of marking sessions that have been passively abandoned. This will be site/app specific. It could be as simple as picking a number of minutes that must pass before the session is considered abandoned - like 10 minutes.

So then you have a query:

SELECT Username,
       SessionStart,
       SessionEnd,
       LastSeenOn,
       DATEDIFF(mi, SessionStart, ISNULL(SessionEnd, LastSeenOn)) DurationMinutes
FROM   SessionAudit
WHERE  SessionEnd IS NOT NULL
OR     DATEDIFF(mi, LastSeenOn, getdate()) > 10

Which will bring back your session audit log.

这篇关于ASP.NET - 记录用户会话开始/结束时间为审计跟踪 - 的Global.asax？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！