StaniTr

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

StaniTr

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

StaniTr

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

StaniTr

//31
if isdate(
str(DATE( 
"31"+"/"+
str(month([Date]))+"/"+
str(year([Date])))
)
)
then 
DATE( 

StaniTr

USE master
CREATE DATABASE sqlPuzzleSessions
ON
--The model database is used as the template for all databases created on an instance of SQL Server.
 
/*Primary data file - contains the startup information for the database; points to the other files in the database.
User data and objects can be stored in this file or in secondary data files.
Every database has one primary data file. (.mdf)*/
 
-- Because MAXSIZE is not specified, the files can grow to fill all available disk space.

StaniTr

--all records: 17403
Select count(actionname) as allLogs
from puzzSessions;
--logOFF: 8687
Select count(ActionName) as cntLOFF
from puzzSessions
where ActionName='LOGOFF';
--logON: 8716
Select count(ActionName) as cntLOFF
from puzzSessions

StaniTr

SELECT Session_ID, TIMESTAMP, datediff(DAY, puzzsessions.TIMESTAMP, sysdatetime()) daysLogged   --logOn time - (current)system time 
FROM puzzSessions
--logon
WHERE ActionName='LOGON' AND session_id NOT IN
        -- no LOGOFF
        (SELECT Session_ID
        FROM puzzSessions
        WHERE ActionName='LOGOFF')
ORDER BY TIMESTAMP DESC --login from 15th and 16th dec 2014 :)))
--RESULT: 31 IDs -  3 LOGONs w/o LOGOFF

StaniTr

SELECT  l1.Session_ID, l1.logontime,l2.logofftime, datediff(HOUR,l1.logontime,l2.logofftime) logDurationHOURS
FROM
                        --SELECT entries both with LOGON and LOGOFF
                        (SELECT  Session_ID, TIMESTAMP logontime
                        FROM puzzSessions
                        WHERE ActionName='LOGON' AND session_id IN(
                                --select entries where no LOGOFF
                                SELECT Session_ID
                                FROM puzzSessions
                                WHERE ActionName='LOGOFF'

StaniTr

SELECT avg(datediff(MINUTE,l1.logontime,l2.logofftime)) avgDuration
FROM
                        --SELECT entries both with LOGON and LOGOFF
                        (SELECT  Session_ID, TIMESTAMP logontime
                        FROM puzzSessions
                        WHERE ActionName='LOGON' AND session_id IN(
                                --select entries where no LOGOFF
                                SELECT Session_ID
                                FROM puzzSessions
                                WHERE ActionName='LOGOFF'

StaniTr

--SELECT entries with LOGOFF w/o LOGON
SELECT Session_ID, TIMESTAMP
FROM puzzSessions
WHERE ActionName='LOGOFF' AND session_id NOT IN(
        --select entries where no LOGOFF
        SELECT Session_ID
        FROM puzzSessions
        WHERE ActionName='LOGON'
)
-- RESULT: 1 ID - 1 LOGOFF --logoff from 14 Dec 2014 --login ?? - hacker