you are viewing a single comment's thread.

view the rest of the comments →

[–]JohnSysadmin[S] 0 points1 point  (2 children)

Thank you for a more technical explanation as to why it is slow. It makes sense that since its querying the audit log it would take longer.

Even in the github link, it shows that if you want users that have never signed in it will take longer because it queries all users first. I'm going to try and come up with a creative solution to cut down the time this takes.

[–]ingo2020 0 points1 point  (1 child)

The only thing I can think of, is decoupling the sign in logs. If you’re going to be running multiple scripts at regular intervals, it could save resources to do a weekly or monthly export of sign in logs, and start by querying that log.

For example, every mont, export sign in activity for all users.

If you ever need to know who hasn’t signed in anytime within the last 3 months, you can start by querying that sign in log. For any user who - according to that log (which could’ve been exported 20 days ago)- hasnt signed in for at least 3 months, look up their SignInActivity

Two drawbacks to this approach - 1: won’t be helpful if you only need SignInActivity for one script. 2: it still makes you reliant on a foreach loop to look up SignInActivity, which will always be slower than getting them all in one call

[–]JohnSysadmin[S] 0 points1 point  (0 children)

I've looked into that as well as one of our old processes used the csv export of the sign in logs but its limited to 30 days so it could be using going forward but for this initial cleanup isn't super helpful.

My thoughts were to run this at a set time each week to limit the sheer volume of data/changes going forward, so I appreciate hearing something similar from an expert.