Skip to main content


This view provides raw historic data about user login/logout activity.

Lacework regularly monitors for user login/logout activity in your environment and returns a row in the USER_LOGIN_V view when Lacework detects a user login/logout activity.

Each row contains user login/logoff information as listed in the columns.

Column NameData TypeDescription
CREATED_TIMETimestampThe time and date when the login or logout was detected by Lacework.
MIDNumberThe Lacework-generated machine identifier for the system that is being logged into or logged out of.
ACTIVITY_TIMETimestampThe time and date when the user logs in or logs out.
ACTIVITY_TYPEText (Login or Logoff)The user activity type, either the string Login or Logout.
USERNAMETextThe username of the user that logged in or logged out.
UIDNumberThe Linux unique identifier associated with the user on this machine.
SOURCE_IP_ADDRTextThe IP address of the system where the login is originating from.