Find User Login Events for An Organization

[KellyGerrow]

The History endpoint of the REST API is a great tool to dig into information about events occurring in your organization. Although you easily download a comprehensive CSV of events as an administrator in ArcGIS Online, the REST API, provides the option to customize the data returned and to ask more specific questions. For an example of how to use the history CSV, check out this blog: https://www.esri.com/arcgis-blog/products/arcgis-/administration/exploring-the-organization-activity... 

For this blog, I am going to explore the needed queries to export information about login events for a specific organization. To use specific parameters with this API currently, the csv format must be used due to: BUG-000120745. This is planned to be addressed in a future release, but the CSV is a great format for large amounts of information.

Scenario: Andy the Administrator wants to understand which of his users have logged into ArcGIS Online and from which apps in February 2019. He has a sneaking suspicion that his employee Oreo J. Sampson doesn’t know his password but is afraid to ask for it to be reset as he asks every single day. Andy is going to verify the login information of his organization to verify

Detective Steps:

1. Formulate the query:

Url: https://sampson23.maps.arcgis.com/sharing/rest/portals/self/history?

Parameters:

all=true – returns events for all members in the organization

start=0 – starts at the first record

num=10000 – largest amount of events returned (requires csv format)

f=csv – returns result in a csv

sortOrder=asc – information output in ascending order

token = “6hVsODGfBpk5X_hGc0MOrnxmddIk4bL4hP8FyOAxM0QxL3VEw86iTdB” – admin token required

fromDate =2019-02-01 – start of date range

toDate=2019-02-28 – end of date range

actions= failedlogin – events to be returned

Sample Url constructed:

https://sampson23.maps.arcgis.com/sharing/rest/portals/self/history?all=true&start=0&actions=failedL...>

2. Submit the request and view the resulting CSV (Failed Login)

Note that some fields have been changed to anonymize data for publication)

3. After inspecting the CSV, you can notice that Oreo failed to login on February 1^st and didn’t fail again.

4. To find out if Oreo ever successfully logged in, just add login to the actions parameter to receive failed login and login events:

https://sampson23.maps.arcgis.com/sharing/rest/portals/self/history?all=true&start=0&actions=failedl...>

Reading the output of the resulting CSV, I can see that Oreo eventually logged into ArcGIS Online using ArcGIS Online and ArcGIS Desktop.

With these results, Andy can understand who has been logging into the organization, successfully, unsuccessfully and from which app.

A note about login actions:

A login action is recorded everytime a successful call is made to the oath2 or generate token login. If you click “Keep me signed in” on the ArcGIS login form then the token will be valid for 2 weeks; the /signin endpoint will not be called and no record will be added to the history log.

*Note. Only available with ArcGIS Online

https://community.esri.com/community/gis/web-gis/arcgisonline/blog/2019/03/16/generate-a-token?sr=se...‌

[Anonymous User]

This is incredibly helpful information, Thanks for the great post!

I am wondering if it is possible to create this same type of log file using the python API and pandas data frame? My management is looking for statistics on user adoption and they want to see the when and how our users are accessing our AGOL site. Ideally, they would love to see stats going back to late 2017 / 2018. From what I can tell the Python API has a history method that could be used; however, I am not able to find a way to filter out unwanted events (i.e. actions=login and a subset of GIS technicians ). Also given the csv limitation (max of 10k events) and the amount of time I need to go back both AGOL Download Activity Log and the Python API history method don’t seem to be great options.

Any suggestions would be greatly appreciated.

@kgerrow@esri.com

[ReinaCMurray]

Thanks for the informative post! 

I have a similar question to Matt's above -- we're trying to get a sense of how many active ArcGIS Pro users we have in a given year. Since we used named accounts, I did a query using the REST API with "actions=login" and "clientId=arcgisprodesktop" as part of the parameters. Worked well, but I'm getting hampered by the 10k limitation. Is there any way to download/access more than 10k rows at a time? 

[KellyGerrow]

Hi,

Matt Martin/USA Martin‌, I'm looking into your questions with the Python API. Will let you know when I have more information.

Reina Murray‌, there is a 10k limit to the amount of records that can be retrieved in a single request. I would recommend either using a filter like search only for login actions to try to limit the query, or make multiple requests to the history api on different dates. This way you can break up your requests so they don't exceed the 10K limit. 

The limit ensures that data queried through this API is performant, so therefor will need logic to parse through different days if you do want to collect and analyze these actions.

[Anonymous User]

Reina Murray‌ My workaround to the 10k max, though not ideal, was to use postman and make multiple requests to the history api as suggested above. However, in doing so I discovered that the history api seemed to ignore my toDate (end of date range) parameter. This meant I ended up getting duplicate events when I combined all of the csv exports together. I used the “ReqID” field as the unique identifier to remove all duplicates except the first occurrence. This can be easily done in excel using a free add-in called Kutools.

Kelly Gerrow‌ Thank you for looking into this some more for me. I would also like to ask if you know if the history api has a limit to how far it can go back. I tried using the multiple request workflow like you mentioned above using the first and last day of each month (exp. 2018-01-01 to 2018-01-31).

My hope was to start at Jan 1st 2018 and go month by month till I reached the current date (Jan 9th 2020). The weird thing was that it was not until August (2018-08-01 to 2018-08-31) that I got my first login result of Dec 6, 2018.

I know I should have had login events prior to this date as I am able to view older content creation, deletion, and sharing events using the download activity log, located on the AGOL organization overview page. Any additional resources you may know of would be incredibility helpful.

Thank you again!!!

[FranciscoHernandez2]

I tried with my ArcGIS Enterprise 10.7.1, but always the csv has not rows.  There is something to do at DataStore or setting some options somewhere?

[FranciscoHernandez2]

I just read the note:  Only available with ArcGIS Online, then I wonder if   this functionality will be migrate toward on-premise environment, I means ArcGIS Enterprise ?

[EricPeña]

Is there a way to view login events on ArcGIS Enterprise?

[SoledadPons_Martinez]

Hi everyone, 

Any update related to login events on ArcGIS Enterprise. I got the same as @FranciscoHernandez2  when I execute the following endpoint:

https://<root>/portal/sharing/rest/portals/self/history?all=true&start=0&actions=failedLogin&sortOrd...

The csv output file (auditLog.csv) have empty rows. Is there any alternative to obtain a tracking report?

Thanks, 

S.