[SOLVED] Last Login Time in Admin Console

[soxfan]

Version 5.0 brought a new feature to the Accounts tab showing Last Login Time. (At least I think it was new in 5.0). Unfortunately this information does not seem to be accurate. I had noticed it a few weeks ago when investigating an issue with a user. Admin console showed the user hadn't logged into Zimbra for about a week. When I questioned the user he said he logged in and out every day. Didn't get a chance to look into it any further then, but I had reason to check it again for another user this morning and again it proved not to be correct. I verified with my own account. I logged out and back in to Zimbra, but the "Last Login Time" did not seem to be updated.

I'm thinking this might be related to the "Auth Token Lifetime" setting, but I'm not sure. I currently have this set to 2 days for everyone. So, am I right in thinking I need to change this setting, and if so what would I need to set it at to get more accurate info in the Admin Console? Or is this just a bug? I did Bugzilla and the forums before posting this and came up empty. Hopefully I didn't miss anything.

[mmorse]

Check your zimbraLastLogonTimestampFrequency (default is 7d to cutdown on ldap writes every time you auth...)
It's your call - you can set it to values like: 1d, 1h, 1m, 1s, or 0 for disabled.

zmprov mcf zimbraLastLogonTimestampFrequency 3d

See also Bug 24012 - "Last logged in" not updating when using external LDAP fixed for 5.0.3

[soxfan]

Thanks Mike. I'm thinking 1 day might be a good setting, since it would show if a user logged in on a particular day. Just curious though, and so I have a better understanding of the setting. What's the purpose of having the "Last Login" column in the Admin console if it doesn't really show an accurate time of when a user actually logged in?

[mmorse]

The value isn't new, just now displayed in the admin console. The server will update the user's zimbraLastLogonTimestamp user attribute at most once every zimbraLastLogonTimestampFrequency.
Think of the pure volume of some systems, updating an attribute for a half-million+ active users all day long makes for a lot of writes and replication. Prompted implementation of: Bug 18972 - provide way to completely disable zimbraLastLogonTimestamp (setting to 0).

Your /opt/zimbra/log/audit.log is continuous anyways so you can always check that. I believe there is a database entry for LAST_SOAP_ACCESS (getLastSoapAccessTime) not ported to a LDAP value because that would be nuts. For some, 7 days does seem a little high though given the average installation size and faster systems. To that end, someone had an bugzilla entry in to get the default changed from 7d > 3d but I don't know what happened to it. If you have the time/ability for a large scale performance test go for it

[soxfan]

Thanks again Mike. I can understand the system performances issues associated with this being updated all the time. Although I guess I have to question how often people are actually logging in and out of the server. Don't most people, in an office environment at least, open their e-mail client when they start the day and leave it open until they leave? Or maybe I'm not understanding what "login" means in this case.

Not to beat a dead horse here. I guess I still don't understand why anyone would want inaccurate information displayed in the Admin Console, but that's just my opinion. I now understand why it's not accurate, what I can do to change it, and the consequences of doing so. So, all good on my end and thanks again.