AppStream Logins Test

In the AWS AppStream Multi-session environment, multiple users login to the AWS AppStream Multi-session Host to access various applications. In such environments, authenticity of the users is important for administrators to securely deliver the applications only to the authorized users. To achieve this, administrators should continuously monitor the user logins to identify unauthorized access attempts or suspicious login patterns. The AppStream Logins test helps administrators in this regard1

This test monitors the user logins to the target AWS AppStream Multi-session Host and reports the total count of logins and logouts. The detailed diagnosis reported by this test reveals which user logged into the target host and when the user logged into the target host. Using these details, administrators can quickly identify unauthorized users.

Target of the test : An AWS AppStream Multi-session Host

Agent deploying the test : An internal agent

Outputs of the test : One set of results for the AWS AppStream Multi-session Host that is being monitored

Configurable parameters for the test
Parameters Description

Test Period

How often should the test be executed.

Host

The host for which the test is to be configured.

Port

The port at which the target host listens.

Report Using ManagerTime

By default, this flag is set to Yes, indicating that, by default, the detailed diagnosis of this test, if enabled, will report the shutdown and reboot times of the target host in the manager’s time zone. If this flag is set to No, then the shutdown and reboot times are shown in the time zone of the system where the agent is running (i.e., the system being managed for agent-based monitoring, and the system on which the remote agent is running - for agentless monitoring).

Report By Domain name
  • By default, this flag is set to Yes. This implies that by default, the detailed diagnosis of this test will display the domainname\username of each user who accessed an application on the host. This way, administrators will be able to quickly determine which user logged into the host from which domain. If you want the detailed diagnosis to display only the username of these users, set this flag to No.
    		•

    DD Frequency

    Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.

    Detailed Diagnosis

    To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

    The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

    • The eG manager license should allow the detailed diagnosis capability
    • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.
    Measurements made by the test
    Measurement Description Measurement Unit Interpretation

    New logins

    Indicates the number of new logins to the target host.

    Number

    A consistent zero value could indicate a connection issue.

    If this measure reports a non-zero value, use the detailed diagnosis of the measure to know which user logged into the target host and when the user logged into the target host.

    Percent new logins

    Indicates the percentage of current sessions that logged in during the last measurement period.

    Percent

     

    Sessions logging out

    Indicates the number of sessions that have logged out from the target host.

    Number

    If all the current sessions suddenly log out, it indicates a problem condition that requires investigation.

    The detailed diagnosis of this measure lists the user who logged out from the target host, the time stamp at which the user logged in, the total session duration of the user in minutes , the time period during which the user was idle in minutes and the percentage of idle time duration.