We wanted to keep track of all user logon activity across our Windows servers. We utilise GrayLog and track eventID’s on our servers to ensure that there isn’t any log on, log off and failed logons that is out of the norm.
As you can see in the dashboard we also keep track of the event id’s in our servers. This helps us identify the servers mostly application servers that are generating the most noise in our environment.