<?xml version="1.0"?>
<configuration>
    <appender name="NodeUserLogger" type="log4net.Appender.UdpAppender">
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Start session" />
        </filter>
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Stop session" />
        </filter>
        <filter type="log4net.Filter.DenyAllFilter" />
        <param name="remoteAddress" value="<FQDN or IP of server where Butler is running>" />
        <param name="remotePort" value="9997" />
        <layout type="log4net.Layout.PatternLayout">
            <converter>
                <param name="name" value="hostname" />
                <param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.HostNamePatternConverter" />
             </converter>
            <param name="conversionpattern" value="%hostname;%property{Command};%property{UserDirectory};%property{UserId}" />
        </layout>
    </appender>
  <logger name="AuditActivity.Proxy">
      <appender-ref ref="NodeUserLogger" />
  </logger>
</configuration>

<?xml version="1.0"?>
<configuration>
    <appender name="NodeUserLogger" type="log4net.Appender.UdpAppender">
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="connection Opened for session" />
        </filter>
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="connection Closed for session" />
        </filter>
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Start session for user" />
        </filter>
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Stop session for user" />
        </filter>
        <filter type="log4net.Filter.DenyAllFilter" />
        <param name="remoteAddress" value="<FQDN or IP of server where Butler is running>" />
        <param name="remotePort" value="9997" />
        <layout type="log4net.Layout.PatternLayout">
            <converter>
                <param name="name" value="hostname" />
                <param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.HostNamePatternConverter" />
            </converter>
            <param name="conversionpattern" value="%hostname;%property{Command};%property{UserDirectory};%property{UserId}" />
        </layout>
    </appender>
 
    <logger name="AuditActivity.Proxy">
        <appender-ref ref="NodeUserLogger" />
    </logger>
</configuration>

Add connection open/close tracking to user events notifications
Add connection open/close tracking to user events notifications
