The logoff logs, PC shutdown logs, PC suspension logs will not be sent to the server immediately. They are saved on the local disk first and then sent to the Management Server. It may take some time before the logs can be searched on the Log Viewer.
If the power of a PC is cut off by force, the logoff log and PC shutdown log will be created at next start of the client (CT). Therefore, it may take some time before the logs can be searched on the Log Viewer.
If the power of a PC is cut off by force at the moment of logoff, two logoff logs for the user may be created sometimes.
Under Windows 7, the logoff logs of all logon users at the time when power of a PC is cut off by force will be recorded.
When you perform shutdown before logging on while the fast startup feature is enabled in Windows 8.1 and Windows 10, a PC suspension log rather than a PC shutdown log may be obtained. In addition, the next time that the operating system is started, a PC recovery log rather than a PC startup log may be obtained. The transfer target information file and CT operation parameter information file update operations, the CT policy request operation, and the self version upgrade check that are normally performed when a PC starts may not work. To ensure that these operations are performed properly, restart the operating system instead of shutting down.
When our unique feature is used to monitor increases in the number of sessions, a session increase triggers the creation of a logon log. This log is not created in conjunction with the security auditing log in the event log.
The only trigger (operation) for creation of the logon and logoff logs is an interactive logon operation to Windows.
