AUE_SESSION_END

Fin de session

Cet évènement est généré lorsqu’un utilisateur se déconnecte d’une session ou lorsqu’un processus met fin à une session, par exemple à la suite du redémarrage ou de l’extinction de l’ordinateur.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_SESSION_END Example

Exemple de journal de télémétrie pour une fin de session.

{
  "arguments": {
    "am_success": 0,
    "am_failure": 0,
    "sflags": 0
  },
  "exec_chain": {
    "uuid": "79997063-82EE-49EA-A394-9CE6D66C2771"
  },
  "exec_chain_child": {
    "parent_path": "",
    "parent_pid": -1,
    "parent_uuid": ""
  },
  "header": {
    "time_seconds_epoch": 1657906405,
    "time_milliseconds_offset": 558,
    "version": 11,
    "event_modifier": 0,
    "event_id": 44903,
    "event_name": "AUE_SESSION_END"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "key": "AAD04E7B-99A0-4BFC-8774-2D5D6F846F4E",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100140,
    "group_id": 0,
    "process_name": "",
    "effective_user_name": "root",
    "user_id": 0,
    "group_name": "wheel",
    "parent_uuid": "",
    "uuid": "79997063-82EE-49EA-A394-9CE6D66C2771",
    "effective_group_id": 0,
    "process_hash": "",
    "audit_id": 4294967295,
    "responsible_process_id": 0,
    "process_id": 0,
    "parent_path": "",
    "effective_group_name": "wheel",
    "audit_user_name": "",
    "effective_user_id": 0,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 0
    },
    "responsible_process_name": "",
    "user_name": "root"
  }
}