Hi Gord, >So, does a 538 occur if the machine is undocked/when the machine >blue screens/power button is hit? If so, is this after the server's configured >disconnect time, or immediately when the TCP session disconnects at the client? Logoff events are generated after undock, if the net adapter goes away and network sessions go away. Whether they are associated with TCP close depends on the service authenticating the user (IIS vs. SMB server, etc.)- if the remote machine actually disconnects or is forcibly disconnected you will see them. They tend not to be generated when the OS is not running due to unexpected power outage. They might be generated after hibernate, if they were queued before power was removed. Eric ------------------------------------------------------------ This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Ce courrier électronique est confidentiel et protégé. L'expéditeur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) désigné(s) est interdite. Si vous recevez ce courrier électronique par erreur, veuillez m'en aviser immédiatement, par retour de courrier électronique ou par un autre moyen. ============================================================ _______________________________________________ LogAnalysis mailing list LogAnalysisat_private http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Tue Jun 24 2003 - 10:56:04 PDT