User Horizon Events seems not to macth if TimePeriod filter is changed

[salcinad]

I need to provide an report when the assigned user was last logged in to his dedicated VDI. We have here one Horizon 7.13.1 Connection Server and one VMware UAG.

I was able, with help from Wouter Kursten Horizon View vCheck [1] code, to create an Script which will do most of my need.

But if I get user Events with filters below, they are not the same. If I take for example "month" as TimePeriod, then it's last Logged In Date and Time will be different then the with "all" as TimePeriod Filter.

PS C:\scripts\Horizon> $lastlogoneventmonth = (Get-HVEvent -HvDbServer $eventdb -TimePeriod 'month' -SeverityFilter AUDIT_SUCCESS -MessageFilter 'has logged in' -UserFilter User1).events | Select-Object -Last 1
Number of records found :  8

PS C:\scripts\Horizon> $lastlogoneventall = (Get-HVEvent -HvDbServer $eventdb -TimePeriod 'all' -SeverityFilter AUDIT_SUCCESS -MessageFilter 'has logged in' -UserFilter User1).events | Select-Object -Last 1
Number of records found :  20

PS C:\scripts\Horizon> $lastlogoneventmonth
UserName  : domain1\User1
Severity  : AUDIT_SUCCESS
EventTime : 10/22/2021 06:35:31.593
Module    : Broker
Message   : User domain1\User1 has logged in

PS C:\scripts\Horizon> $lastlogoneventall
UserName  : domain1\User1
Severity  : AUDIT_SUCCESS
EventTime : 08/20/2021 06:39:44.717
Module    : Broker
Message   : User domain1\User1 has logged in
PS C:\scripts\Horizon> 

Could someone explain this or have some other solution on how to get user Last Logon Date/Time.

[1] https://www.retouw.nl/2017/06/06/building-a-horizon-view-vcheck-part-3-2/

@Magneetthanks for your greate Blog Archive which helped me a lot to learn about Horizon API.

[LucD]

I suggest opening an Issue on the vCheckReport/vCheck-HorizonView repo.

[salcinad]

I am actually not using vCheck but some code from it. In the Link posted in first post, I am using code from "13 Dedicated Full Clones Assignment.ps1" and "14 Manual Desktop Pool Information.ps1" which I then combined with Get-HVEvents.

We have here Manuel Desktop Pool with Dedicated VDIs.

Only the problem is, that Get-HVEvent does not get me same DateTime when using TimePeriod filters. Maybe I am doing it wrong there.

[LucD]

Could it be that one shows the time in UTC and the other in your local timezone?

[salcinad]

Tiime is not that important, actually Time will not be used at all. If you look in the first post, you will see that Date is what I get wrongly (I think) for the same user, just using different TimePeriod.

[salcinad · Accepted solution]

With the help of co-worker, who explained me that the Database Date are kept in memory and weird sorted, that I should Use "Sort-Object EventTime" and then “select-object first 1” in this case, which lead to the solution suitable for my need.

$lastlogonevent = (Get-HVEvent -HvDbServer $eventdb -TimePeriod 'month' -SeverityFilter AUDIT_SUCCESS -MessageFilter 'has logged in' -UserFilter $username[1]).events | Sort-Object EventTime -Descending | Select-Object -First 1

Seems there are some weird (at least for me) sorting stuff going on in VMware.Hv.Helper Get-HVEvent function (link below) but they are out of my knowledge to propose any fix.

https://github.com/vmware/PowerCLI-Example-Scripts/blob/master/Modules/VMware.Hv.Helper/VMware.HV.He...