Emerson Exchange 365

• Not Answered

REMOTE LOGON and REMOTE LOGOFF Events Frequently Occur with No Remote Access

I have a DeltaV system with one ProPLus, one Application Station, and Two Operator Stations that are all part of a Workgroup. The Event Chronicle regularly (approximately 500 a day) records "REMOTE LOGON" and "REMOTE LOGOFF" events for the two operator stations and the ProPlus. I've never noticed them for the App Station. There is no RDP or other remote access. The workstations are typically left with a user always logged in, so nobody is locally logging off and then logging back in. Any idea?

A sample below:

Timestamp [Local]	Event Type	Category	Area	Node	Module	Module Description	Parameter	State	Level	Desc1
4/12/17 7:09:09 AM	CHANGE	USER	AREA_A	ROCS-94				REMOTE LOGON		ADMINISTRATOR
4/12/17 7:09:11 AM	CHANGE	USER	AREA_A	ROCS-94				REMOTE LOGON		ADMINISTRATOR
4/12/17 7:09:34 AM	CHANGE	USER	AREA_A	ROCS-94				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 7:09:34 AM	CHANGE	USER	AREA_A	ROCS-94				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 7:53:47 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 7:57:18 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:14:28 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:15:41 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:17:54 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:19:06 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:33:22 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:35:41 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:51:12 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:52:33 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:52:41 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:54:25 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:55:20 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:57:13 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 9:57:14 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 9:59:00 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGOFF		ADMINISTRATOR
4/12/17 10:28:53 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR
4/12/17 10:32:39 AM	CHANGE	USER	AREA_A	RECS-91				REMOTE LOGON		ADMINISTRATOR

Also took this screenshot of the Remote Clients of the ProPlus:

• Logoff
• event chronicle
• logon

JoshC

• 13 Apr 2017 1:25 PM
• Cancel

9 Replies

• Charles Reblin

  

  • 5 Sep 2017 3:10 PM

  kmdcs,
  
  I am seeing a similar issue. Several REMOTE LOGOFFs/LOGONs to the ProPlus node by an administrative account and REMOTE LOGOFFs/LOGONs to the two operator workstation nodes by the operator account. Were you able to come to any conclusions?
  
  -Charlie

  • Cancel
• JoshC

  

  • 11 Sep 2017 12:09 PM

  In reply to Charles Reblin:

  No, I've had a ticket open with Guardian support for several months but they have been extremely unhelpful. I'll post here if a solution is ever found.

  • Cancel
• Bill Sayers

  

  • 11 Sep 2017 12:25 PM

  In reply to JoshC:

  I too have noticed the same thing and was wondering why. Would like to hear your answer when you find out!

  • Cancel
• Mike Link

  

  • 11 Sep 2017 1:01 PM

  Those Remote Logon / Logoff appear when you open / close DeltaV database connections. So opening a module in control studio will create a logon event, and closing will create a logoff event.

  • Cancel
• JoshC

  

  • 12 Sep 2017 3:01 PM

  In reply to Mike Link:

  This is the explanation from Guardian:

  • LOGON/LOGOFF – events are logged when DeltaV user logs on / logs off in Flexlock.
  • REMOTE LOGON – are logged when you open or launch DeltaV applications like DV Explorer, Control Studio, PHV, OPC Client.
  • REMOTE LOGOFF - are logged when you close DeltaV applications like DV Explorer, Control Studio, PHV, OPC Client.

  
  However, there are many days when the plant has 300-500 of the REMOTE LOGON/LOGOFF events and Operate (Run) is running the whole time and no other applications are being opened or closed (including Control Studio, Explorer, etc). There are no external OPC connections or remote connectivity. It is a very basic DeltaV 12.3.1 installation.

  • Cancel
• Alan K

  

  • 12 Sep 2017 3:09 PM

  All 4 of our DeltaV systems suffer from the exact same issue. Has been going on for years, as long as I can remember.
  
  These hundreds and hundreds of phantom nuisance entries clog up the event journal and make it hard to troubleshoot real events

  • Cancel
• Rick Gorskie

  

  • 12 Sep 2017 3:23 PM

  In reply to Alan K:

  Have any of these instances been reported to the GSC? If so, is there a case number that we can look in to?

  Rick Gorskie

  Global Sales Manager - Cybersecurity

  Emerson Automation Solutions

  • Cancel
• JoshC

  

  • 13 Sep 2017 2:42 PM

  In reply to Rick Gorskie:

  Case number for mine is NC-1701-6934. Their best solution offered so far is to export the events and filter out the nuisance ones in Excel. Not a solution and not a very good workaround, particularly for Operations.

  • Cancel
• JoshC

  

  • 17 May 2018 4:37 PM

  In reply to JoshC:

  Received a final response from GSC this week. Since this issue is "a cosmetic issues with a filtering workaround, no product changes for v12.3.1 are planned". I would be OK with that if there actually was a way to filter out the REMOTE LOGON and REMOTE LOGOFF events but to my knowledge the only filtering available in PHV is inclusive (i.e. what you select in the filter is what is displayed).

  • Cancel